Static task
static1
Behavioral task
behavioral1
Sample
2024-04-22_9be1c32b0c8571bb1f6506dfdb9379dc_icedid.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-22_9be1c32b0c8571bb1f6506dfdb9379dc_icedid.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-22_9be1c32b0c8571bb1f6506dfdb9379dc_icedid
-
Size
1.6MB
-
MD5
9be1c32b0c8571bb1f6506dfdb9379dc
-
SHA1
846b918e4ac1b404c3f47869246ece0d92206538
-
SHA256
a0cf8672d2358c5abc5df5b2d561c8b7f8fbf4bbf8b0c8b1ef2d0918aface791
-
SHA512
db7860d606791b459893de2c4aabd0281c338df0b3e735c833bfda7f73ce46dc2d546760f05bee079d50cb0219bcc947dd5b5050eecd63e103674a054cd818ad
-
SSDEEP
24576:4qsXRjf43J0CTCBf61wXR3CkEgE0ZAATOD/ePyqt7Uu2VwyUBsiwe02cT9HSvdS0:QICggEQnOD/1qt7TyCBsQhC9HEdSY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-04-22_9be1c32b0c8571bb1f6506dfdb9379dc_icedid
Files
-
2024-04-22_9be1c32b0c8571bb1f6506dfdb9379dc_icedid.exe windows:4 windows x86 arch:x86
718763335b56e1453c9447e858c10b08
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
PlaySoundA
kernel32
TlsSetValue
LocalReAlloc
TlsFree
GetCPInfo
GetOEMCP
SetErrorMode
GetCurrentDirectoryA
FindResourceExA
HeapAlloc
HeapFree
RtlUnwind
VirtualAlloc
GetSystemInfo
VirtualQuery
GetLocalTime
GetTimeFormatA
GetDateFormatA
GetSystemTimeAsFileTime
GetStartupInfoA
HeapReAlloc
SetEnvironmentVariableA
SetCurrentDirectoryA
ExitProcess
ExitThread
SetStdHandle
GetFileType
TerminateProcess
TlsAlloc
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetUnhandledExceptionFilter
GetCurrentProcessId
IsBadReadPtr
IsBadCodePtr
TlsGetValue
GlobalHandle
GlobalReAlloc
GlobalFlags
LocalAlloc
LocalLock
LocalUnlock
GetTickCount
InterlockedIncrement
VirtualProtect
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
LocalFileTimeToFileTime
FileTimeToLocalFileTime
FindNextFileA
SystemTimeToFileTime
FileTimeToSystemTime
WaitForMultipleObjects
ReleaseMutex
CreateMutexA
GetTempFileNameA
GetFileTime
SetFileTime
SuspendThread
ResumeThread
SetThreadPriority
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
InterlockedDecrement
RaiseException
GetShortPathNameA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
DeleteFileA
SetLastError
GlobalFree
MulDiv
FreeResource
GetCurrentThreadId
GlobalFindAtomA
GlobalDeleteAtom
LoadLibraryA
FreeLibrary
lstrcmpW
GetModuleHandleA
GetProcAddress
GlobalGetAtomNameA
GlobalAddAtomA
lstrcpynA
lstrcatA
SetVolumeLabelA
GetDiskFreeSpaceA
GetDriveTypeA
CreateDirectoryA
GetFileAttributesA
SetFileAttributesA
FlushViewOfFile
CopyFileA
lstrcmpA
GetCommandLineA
OpenFileMappingA
PulseEvent
SetEvent
GetExitCodeThread
MoveFileA
QueryPerformanceFrequency
FormatMessageA
LocalFree
QueryPerformanceCounter
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GlobalAlloc
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetPrivateProfileStructA
lstrcpyA
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
WinExec
GetTempPathA
GlobalLock
GlobalUnlock
CreateThread
Sleep
ReadFile
WriteFile
GetOverlappedResult
CreateFileA
SetupComm
SetCommTimeouts
CreateEventA
GetStringTypeExA
CompareStringW
CompareStringA
GetCommMask
ResetEvent
WaitForSingleObject
WaitCommEvent
SetCommMask
SetCommState
GetCommState
TransmitCommChar
CloseHandle
ClearCommError
PurgeComm
lstrlenA
lstrlenW
lstrcmpiA
GetVersion
FindResourceA
LoadResource
LockResource
SizeofResource
GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetExitCodeProcess
HeapSize
CreateProcessA
user32
GetSysColorBrush
GetTabbedTextExtentA
IsClipboardFormatAvailable
SetWindowContextHelpId
ShowOwnedPopups
DestroyCursor
SetCursorPos
MapDialogRect
PostQuitMessage
SetParent
GetSystemMenu
DeleteMenu
WaitMessage
GetWindowThreadProcessId
LoadCursorA
WindowFromPoint
MsgWaitForMultipleObjects
GetMenuItemInfoA
InflateRect
GetMessageA
ValidateRect
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetMenuStringA
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
GetMenuCheckMarkDimensions
MoveWindow
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassInfoExA
SetPropA
GetPropA
RemovePropA
SendDlgItemMessageA
IsChild
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
MapWindowPoints
TrackPopupMenu
SetScrollRange
SetScrollPos
GetScrollPos
DeferWindowPos
RegisterClassA
SetWindowPlacement
DefWindowProcA
CallWindowProcA
GetWindowPlacement
GetSystemMetrics
DestroyMenu
GetClassNameA
WinHelpA
SetFocus
EqualRect
GetDlgItem
GetDlgCtrlID
UnpackDDElParam
ReuseDDElParam
LoadIconA
GetClassInfoA
SetCursor
PeekMessageA
GetCapture
LoadAcceleratorsA
SetActiveWindow
IsWindowVisible
InsertMenuItemA
CreatePopupMenu
OffsetRect
SetRectEmpty
CopyRect
GetLastActivePopup
SetMenu
ShowWindow
GetDesktopWindow
IsWindowEnabled
AdjustWindowRectEx
RedrawWindow
SetWindowPos
SetWindowLongA
IsWindow
TranslateAcceleratorA
TranslateMDISysAccel
CreateWindowExA
GetActiveWindow
DrawMenuBar
GetMenuItemCount
GetMenuItemID
DefMDIChildProcA
GetMenu
DefFrameProcA
OemToCharA
CharToOemA
RemoveMenu
InsertMenuA
GetAsyncKeyState
ReleaseCapture
ShowScrollBar
SetCapture
IntersectRect
IsRectEmpty
wsprintfA
SetForegroundWindow
RegisterWindowMessageA
LoadBitmapA
RegisterClipboardFormatA
GetDCEx
PostThreadMessageA
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableA
EmptyClipboard
SetClipboardData
IsZoomed
GetWindowLongA
GetFocus
DrawFocusRect
PtInRect
MessageBoxA
GetParent
TranslateMessage
DispatchMessageA
MessageBeep
FindWindowA
BringWindowToTop
PostMessageA
GetCursorPos
KillTimer
SetTimer
CheckMenuItem
CharNextA
DestroyIcon
UnregisterClassA
LockWindowUpdate
ReleaseDC
GetDC
GetClipboardData
CloseClipboard
OpenClipboard
GetWindow
InvalidateRect
UpdateWindow
GetClientRect
AppendMenuA
GetKeyState
GetMessagePos
ScreenToClient
LoadMenuA
GetSubMenu
EnableMenuItem
EnableWindow
GetWindowRect
IsIconic
SetRect
GetSysColor
FillRect
SendMessageA
CharUpperA
SystemParametersInfoA
gdi32
StretchDIBits
GetCharWidthA
CreateFontA
GetTextMetricsA
DPtoLP
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
GetTextAlign
DeleteMetaFile
SetRectRgn
CombineRgn
GetMapMode
GetBkColor
EnumFontFamiliesExA
GetTextColor
GetRgnBox
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
SetMapMode
SetROP2
SetBkMode
RestoreDC
GetStockObject
CreatePatternBrush
DeleteDC
ExtSelectClipRgn
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
StartDocA
GetPixel
GetWindowExtEx
GetViewportExtEx
CreateRectRgn
SelectClipRgn
DeleteObject
CreateSolidBrush
SaveDC
CreateRectRgnIndirect
CreateDCA
GetDeviceCaps
CreateBitmap
GetObjectA
SetBkColor
SetTextColor
GetClipBox
CloseMetaFile
CreateMetaFileA
BitBlt
GetROP2
CreateFontIndirectA
CreateHatchBrush
CreatePen
GetTextExtentPoint32A
PatBlt
CreateCompatibleDC
CreateCompatibleBitmap
Rectangle
Ellipse
Polyline
comdlg32
PrintDlgA
CommDlgExtendedError
ChooseFontA
GetOpenFileNameA
ReplaceTextA
ChooseColorA
GetFileTitleA
FindTextA
GetSaveFileNameA
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
GetJobA
advapi32
RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyA
RegDeleteValueA
RegEnumKeyA
RegQueryInfoKeyA
RegEnumValueA
RegSetValueA
SetFileSecurityA
GetFileSecurityA
RegQueryValueA
RegCreateKeyA
RegQueryValueExA
shell32
DragQueryFileA
SHBrowseForFolderA
DragAcceptFiles
ShellExecuteA
ExtractIconA
SHGetFileInfoA
SHGetPathFromIDListA
DragFinish
ShellExecuteExA
comctl32
ImageList_AddMasked
ImageList_GetImageInfo
ImageList_Draw
ord17
ImageList_Destroy
ImageList_Create
ImageList_LoadImageA
ImageList_DrawIndirect
PropertySheetA
DestroyPropertySheetPage
ord8
CreatePropertySheetPageA
shlwapi
PathIsUNCA
PathFindExtensionA
PathStripToRootA
PathFindFileNameA
oledlg
ord8
ole32
StgOpenStorageOnILockBytes
CoGetClassObject
CoDisconnectObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CoRevokeClassObject
CoRegisterClassObject
CLSIDFromString
CoCreateInstance
OleRun
CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
CLSIDFromProgID
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
oleaut32
LoadTypeLi
OleCreateFontIndirect
SystemTimeToVariantTime
SafeArrayDestroy
SafeArrayPutElement
VariantCopy
SafeArrayCreate
SafeArrayGetElemsize
SysAllocString
SysStringByteLen
SysAllocStringByteLen
SysStringLen
SysFreeString
VariantInit
VariantChangeType
VarDateFromStr
GetActiveObject
VariantClear
SysAllocStringLen
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 216KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 300KB - Virtual size: 298KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ