Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22/04/2024, 20:09
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe
-
Size
2.3MB
-
MD5
59c0ac791aa6dadbdc7ed8ae2156d61e
-
SHA1
87db6ce7586a1632aafd91c1b193c2eafa43229f
-
SHA256
da4c4bffb2ee9d7f68e3ed31af82b0b9f40f09956d5fdaa256f217afd7ac3787
-
SHA512
4e6473a42f4dca659fa550f69feecf31a5f88a0d45c8aeb10e8b76fce2ab35d078c77c0476812cff586a002842f4ee87aef715955ccb599f2dda8697006c2a32
-
SSDEEP
49152:K3Mzz9JpLKwhvFY9A8/KVtoKArx+KOw9xV1XL4Is6OBNPJd02K:eMzz9JhKyFY9A8/KVtaDOw9xV1XJs5Bh
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3008 11AD.tmp -
Loads dropped DLL 2 IoCs
pid Process 2232 2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe 2232 2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\mfc100u.dll 11AD.tmp File created C:\Windows\SysWOW64\mfc40u.dll 11AD.tmp File created C:\Windows\SysWOW64\rdvgumd32.dll 11AD.tmp File created C:\Windows\SysWOW64\setupSNK.exe 11AD.tmp File created C:\Windows\SysWOW64\explorer.exe 11AD.tmp File created C:\Windows\SysWOW64\msrd3x40.dll 11AD.tmp File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-MediaPlayer\MediaPlayer-DLMigPlugin.dll 11AD.tmp File created C:\Windows\SysWOW64\audiodev.dll 11AD.tmp File created C:\Windows\SysWOW64\FXSXP32.dll 11AD.tmp File created C:\Windows\SysWOW64\mspbde40.dll 11AD.tmp File created C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igdumd32.dll 11AD.tmp File created C:\Windows\SysWOW64\regedit.exe 11AD.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\amdpcom32.dll 11AD.tmp File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 11AD.tmp File created C:\Windows\SysWOW64\migration\MediaPlayer-DLMigPlugin.dll 11AD.tmp File opened for modification C:\Windows\SysWOW64\vccorlib120.dll 11AD.tmp File created C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\nvd3dum.dll 11AD.tmp File created C:\Windows\SysWOW64\InstallShield\setup.exe 11AD.tmp File opened for modification C:\Windows\SysWOW64\concrt140.dll 11AD.tmp File created C:\Windows\SysWOW64\crtdll.dll 11AD.tmp File created C:\Windows\SysWOW64\dmscript.dll 11AD.tmp File created C:\Windows\SysWOW64\msexch40.dll 11AD.tmp File created C:\Windows\SysWOW64\odbcjt32.dll 11AD.tmp File opened for modification C:\Windows\SysWOW64\vcomp140.dll 11AD.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdag.dll 11AD.tmp File opened for modification C:\Windows\SysWOW64\atl100.dll 11AD.tmp File opened for modification C:\Windows\SysWOW64\atl110.dll 11AD.tmp File created C:\Windows\SysWOW64\mfc40.dll 11AD.tmp File opened for modification C:\Windows\SysWOW64\MSCOMCTL.OCX 11AD.tmp File created C:\Windows\SysWOW64\olecli32.dll 11AD.tmp File opened for modification C:\Windows\SysWOW64\mfc140u.dll 11AD.tmp File opened for modification C:\Windows\SysWOW64\msvcr120.dll 11AD.tmp File opened for modification C:\Windows\SysWOW64\msvcr120_clr0400.dll 11AD.tmp File created C:\Windows\SysWOW64\sqlunirl.dll 11AD.tmp File created C:\Windows\SysWOW64\dplaysvr.exe 11AD.tmp File created C:\Windows\SysWOW64\ir41_32.ax 11AD.tmp File created C:\Windows\SysWOW64\ivfsrc.ax 11AD.tmp File opened for modification C:\Windows\SysWOW64\mfc110u.dll 11AD.tmp File created C:\Windows\SysWOW64\msexcl40.dll 11AD.tmp File created C:\Windows\SysWOW64\msjter40.dll 11AD.tmp File created C:\Windows\SysWOW64\d3d8.dll 11AD.tmp File created C:\Windows\SysWOW64\ir50_32.dll 11AD.tmp File opened for modification C:\Windows\SysWOW64\mfc110.dll 11AD.tmp File opened for modification C:\Windows\SysWOW64\mfc120u.dll 11AD.tmp File created C:\Windows\SysWOW64\msjet40.dll 11AD.tmp File created C:\Windows\SysWOW64\mswstr10.dll 11AD.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdva.dll 11AD.tmp File created C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\nvwgf2um.dll 11AD.tmp File created C:\Windows\SysWOW64\dpwsockx.dll 11AD.tmp File created C:\Windows\SysWOW64\expsrv.dll 11AD.tmp File created C:\Windows\SysWOW64\ir32_32.dll 11AD.tmp File opened for modification C:\Windows\SysWOW64\mfc120.dll 11AD.tmp File opened for modification C:\Windows\SysWOW64\mfc140.dll 11AD.tmp File created C:\Windows\SysWOW64\msltus40.dll 11AD.tmp File opened for modification C:\Windows\SysWOW64\msvcr100.dll 11AD.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atidxx32.dll 11AD.tmp File created C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igd10umd32.dll 11AD.tmp File created C:\Windows\SysWOW64\d3dxof.dll 11AD.tmp File created C:\Windows\SysWOW64\msvcrt20.dll 11AD.tmp File created C:\Windows\SysWOW64\mswdat10.dll 11AD.tmp File created C:\Windows\SysWOW64\dplayx.dll 11AD.tmp File opened for modification C:\Windows\SysWOW64\mfc100.dll 11AD.tmp File created C:\Windows\SysWOW64\msxbde40.dll 11AD.tmp File created C:\Windows\SysWOW64\sqlwoa.dll 11AD.tmp -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLVBS.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SSGEN.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeXMP.dll 11AD.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGM.dll 11AD.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IPDESIGN.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SOA.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONBttnWD.dll 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLPH.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Acrofx32.dll 11AD.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FPERSON.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAME.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MIMEDIR.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONBttnOL.dll 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCNPST32.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VVIEWER.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\MSB1STAR.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\MSB1FREN.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MAPIPH.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLNOTE.FAE 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\FeedSync.dll 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\ColleagueImport.dll 11AD.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\IA32.api 11AD.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7.dll 11AD.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DBGHELP.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCL.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCDDSF.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EMABLT32.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXSEC32.DLL 11AD.tmp File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 11AD.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp 11AD.tmp File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RECALL.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7ES.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\WebKit.dll 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GFX.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NL7Data0011.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\Real.mpp 11AD.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\FPWEC.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EMSMDB32.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\GIFIMP32.FLT 11AD.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\VBAJET32.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSStr32.dll 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OLKFSTUB.DLL 11AD.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Onix32.dll 11AD.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api 11AD.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search5.api 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLACCT.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OL.SAM 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\TRANSMGR.DLL 11AD.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7EN.DLL 11AD.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll 11AD.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\RICHED20.DLL 11AD.tmp -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\x86_microsoft-windows-speechcommon_31bf3856ad364e35_6.1.7601.17514_none_d809b28230ecfe46\sapi.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-audio-dsound_31bf3856ad364e35_6.1.7600.16385_none_5872147ba3367471\dsound.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-deltapackageexpander_31bf3856ad364e35_6.1.7601.17514_none_6be6001a9349f456\dpx.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-wmpeffects_31bf3856ad364e35_6.1.7601.17514_none_fb555132edb3cc33\wmpeffects.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-n..protection-statusui_31bf3856ad364e35_6.1.7600.16385_none_3d715a438950ce7b\NAPSTAT.EXE 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-opengl-msogl_31bf3856ad364e35_6.1.7600.16385_none_fa4180ba207482f7\ogldrv.dll 11AD.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_8.0.7600.16385_none_da5dd271ce714fff\mshta.exe 11AD.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-com-legacyole-olecli32_31bf3856ad364e35_6.1.7600.16385_none_673f800d98f1faf8\olecli32.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.2.9600.16428_none_b436382b203656be\ExtExport.exe 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-mystify_31bf3856ad364e35_6.1.7601.17514_none_f21904fdbd9f5e08\Mystify.scr 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\dpx.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-winlogon-sas_31bf3856ad364e35_6.1.7600.16385_none_794ca3c3dba3387a\sas.dll 11AD.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-wmpencen_31bf3856ad364e35_6.1.7601.17514_none_f5404151ef3a5597\WMPEncEn.dll 11AD.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-netbt_31bf3856ad364e35_6.1.7601.17514_none_c8df7823424473a1\netbtugc.exe 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-console_31bf3856ad364e35_6.1.7600.16385_none_962fb0850dca9554\console.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-directx-directplay8_31bf3856ad364e35_6.1.7601.17514_none_7addf2001d014646\dpnsvr.exe 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..-downlevelmanifests_31bf3856ad364e35_6.1.7601.17514_none_04801f69e1dbd8e6\MediaPlayer-DLMigPlugin.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-rasmprddm_31bf3856ad364e35_6.1.7601.17514_none_9b1dbb102bda64a1\mprddm.dll 11AD.tmp File created C:\Windows\winsxs\x86_netfx-fw_netfxperf_dll_31bf3856ad364e35_6.2.7601.17514_none_5ec9dfb2784680fc\netfxperf.dll 11AD.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-i..lified-chinese-core_31bf3856ad364e35_6.1.7601.17514_none_808c0da292f3ca46\ImSCCore.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-deltacompressionengine_31bf3856ad364e35_6.1.7600.16385_none_4002be3be712af33\mspatcha.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-d3dcompiler_31bf3856ad364e35_11.2.9600.16428_none_f5d566eb2d6d9be1\D3DCompiler_47.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-mail-core_31bf3856ad364e35_6.1.7601.17514_none_eb2fd71ce868a93e\msoert2.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-msports_31bf3856ad364e35_6.1.7600.16385_none_8cf3709c50984f07\msports.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-directshow-mpeg2_31bf3856ad364e35_6.1.7601.17514_none_b81694890087430f\mpg2splt.ax 11AD.tmp File created C:\Windows\winsxs\x86_netfx-dfdll_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_5cd78bb510da3dfc\dfdll.dll 11AD.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-cmi_31bf3856ad364e35_6.1.7601.17514_none_abd5b433b8ccf7a4_cmiv2.dll_be06aa9f 11AD.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_6.1.7601.17514_none_c1fead4e4bf85947\IMTCPROP.exe 11AD.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-drm_31bf3856ad364e35_6.1.7601.17514_none_d6a8cb040fcd3a85\blackbox.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-cryptplugininstaller_1122334455667788_6.1.7600.16385_none_dc2892f93c7df249\cmicryptinstall.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-directshow-dvdsupport_31bf3856ad364e35_6.1.7601.17514_none_562994bd321aac67\qdvd.dll 11AD.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100u_x86 11AD.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-scripting-vbscript_31bf3856ad364e35_11.2.9600.16428_none_3505c0af7755f6ea\vbscript.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-authorizationmanagerui_31bf3856ad364e35_6.1.7601.17514_none_23e160885de79241\azroleui.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-speechengine_31bf3856ad364e35_6.1.7600.16385_none_ee947359fb35d641\srloc.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-xwizards-win32plugin_31bf3856ad364e35_6.1.7600.16385_none_39921b5e838af914\xwtpw32.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_d1c738ec43578ea1\ATL80.dll 11AD.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-drm_31bf3856ad364e35_6.1.7601.17514_none_d6a8cb040fcd3a85\drmmgrtn.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_11.2.9600.16428_none_88216b07fe83d256\wininet.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-pdm-configuration_31bf3856ad364e35_11.2.9600.16428_none_d6876629731ce419\pdm.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-runtimeutilities_31bf3856ad364e35_11.2.9600.16428_none_cddc21e3e934f0b3\iertutil.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.1.7601.17514_none_6dd5e8c3b6b81894\PhotoScreensaver.scr 11AD.tmp File created C:\Windows\winsxs\Backup\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80_gdiplus.dll_423f7010 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-i..nternetcontrolpanel_31bf3856ad364e35_11.2.9600.16428_none_15721d9aae8950e7\inetcpl.cpl 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..r-setup-thunking-32_31bf3856ad364e35_6.1.7600.16385_none_16fe19562e758f02\ds32gt.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-msmq-triggers-runtime_31bf3856ad364e35_6.1.7600.16385_none_58fbaab9a69d9f5e\mqtrig.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-directx-direct3d10.1_31bf3856ad364e35_7.1.7601.16492_none_4348f88492fd6ee6\d3d10_1.dll 11AD.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_114ca177b1fcad24_newdev.dll_7eb7622f 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-a..ce-useractionrecord_31bf3856ad364e35_6.1.7600.16385_none_32c4b0bc55387f75\psr.exe 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-f12diagnosticstap_31bf3856ad364e35_11.2.9600.16428_none_3861e42cd41507eb\DiagnosticsTap.dll 11AD.tmp File created C:\Windows\winsxs\x86_netfx-ngen_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_4c193e6507471ede\ngen.exe 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-vis_31bf3856ad364e35_6.1.7600.16385_none_70c06eb624598059\mpvis.DLL 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-rascmdial_31bf3856ad364e35_6.1.7600.16385_none_d37d716fb6acab61\cmdial32.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-rasgetconnectedwizard_31bf3856ad364e35_6.1.7600.16385_none_39ea34b42d8bab89\rasgcw.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-smartcardksp_31bf3856ad364e35_6.1.7601.17514_none_b7f7d8e8e19ade8a\scksp.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-js-debuggeride_31bf3856ad364e35_8.0.7600.16385_none_5588d4b6d70a655d\jsdebuggeride.dll 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-wpd-legacywmdmcesp_31bf3856ad364e35_6.1.7600.16385_none_bc743c4c6248bf52\cewmdm.dll 11AD.tmp File created C:\Windows\winsxs\x86_netfx-mscories_dll_31bf3856ad364e35_6.1.7601.17514_none_c02a874d500cc338\mscories.dll 11AD.tmp File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-s..ty-protectedstorage_31bf3856ad364e35_6.1.7600.16385_none_ae92b0937e708d46_pstorec.dll_b3635d22 11AD.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-ldap-client_31bf3856ad364e35_6.1.7601.17514_none_f543b182b4adcce6_wldap32.dll_09c99dc1 11AD.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_6.1.7601.17514_none_e99b83c8fd064a06\iisui.dll 11AD.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-mmsys_31bf3856ad364e35_6.1.7601.17514_none_c6ea7a022a2b6909\mmsys.cpl 11AD.tmp File created C:\Windows\winsxs\x86_microsoft-windows-wimgapi_31bf3856ad364e35_6.1.7601.17514_none_8b030c557320a2c1\wimserv.exe 11AD.tmp -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2232 2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe 2232 2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2232 2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe 2232 2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2232 2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe 2232 2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe 2232 2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2232 wrote to memory of 3008 2232 2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe 28 PID 2232 wrote to memory of 3008 2232 2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe 28 PID 2232 wrote to memory of 3008 2232 2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe 28 PID 2232 wrote to memory of 3008 2232 2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-22_59c0ac791aa6dadbdc7ed8ae2156d61e_icedid.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\11AD.tmpC:\Users\Admin\AppData\Local\Temp\11AD.tmp2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3008
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145KB
MD5c610e7ccd6859872c585b2a85d7dc992
SHA1362b3d4b72e3add687c209c79b500b7c6a246d46
SHA25614063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041
SHA5128570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666