Analysis
-
max time kernel
121s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
23-04-2024 04:44
General
-
Target
2024-04-23_10c3cb22ef88829ead39183ac57fc434_icedid.exe
-
Size
1.1MB
-
MD5
10c3cb22ef88829ead39183ac57fc434
-
SHA1
a93acf5d4d71b7f79eb3ebb90f5062973e3752f5
-
SHA256
595d33b6d731c1087e6323434d292e812c1833f0f0c5eaa43167573f422c37a8
-
SHA512
67817013e79bd5a159902c3c03cd00aac40100910aa705fc0c96603883377ca9fa623ec333b719add0a615c0a9f80d70923842d8fc1cb14cb635cf964cbc986f
-
SSDEEP
24576:QZT2K+zRJsT1DQzICqs4DJcahFVpdCX/xXudzc:M27RJeDQzICqLJcEVdCX/xQzc
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 39 IoCs
-
UPX dump on OEP (original entry point) 38 IoCs
-
UPX packed file 38 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 7 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 5 IoCs
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-23_10c3cb22ef88829ead39183ac57fc434_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-23_10c3cb22ef88829ead39183ac57fc434_icedid.exe"1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\dayqgn.exeFilesize
100KB
MD5d86c084eceea0da00e1f8781dc3f3b56
SHA11b592ac7a530b95329eede1f10d6429a629c00d7
SHA256b0987b6320bd45ff39380979e980bdce01e7c529c2ed8a2a748613a4a8c260ac
SHA51207be17b7bd2aec0ee8acc79b077c1741cd77abfee06f2ab17fd2783297b0b1d4ca704ef228a34a3891734006767c9a63e0e5d3c37a3f24869399c8df92967f6d
-
memory/1104-12-0x0000000002050000-0x0000000002052000-memory.dmpFilesize
8KB
-
memory/1244-29-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-63-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-19-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-20-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-21-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-22-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-18-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-11-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-10-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-9-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-8-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-7-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-6-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-34-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-24-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-27-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-25-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-30-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-78-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-5-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-4-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-38-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-44-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-37-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-47-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-46-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-49-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-51-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-55-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-54-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-57-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-59-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-62-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-32-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-65-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-67-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-2-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1244-0-0x0000000000400000-0x000000000051B000-memory.dmpFilesize
1.1MB
-
memory/1244-79-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB