Analysis
-
max time kernel
128s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
23-04-2024 04:44
General
-
Target
2024-04-23_10c3cb22ef88829ead39183ac57fc434_icedid.exe
-
Size
1.1MB
-
MD5
10c3cb22ef88829ead39183ac57fc434
-
SHA1
a93acf5d4d71b7f79eb3ebb90f5062973e3752f5
-
SHA256
595d33b6d731c1087e6323434d292e812c1833f0f0c5eaa43167573f422c37a8
-
SHA512
67817013e79bd5a159902c3c03cd00aac40100910aa705fc0c96603883377ca9fa623ec333b719add0a615c0a9f80d70923842d8fc1cb14cb635cf964cbc986f
-
SSDEEP
24576:QZT2K+zRJsT1DQzICqs4DJcahFVpdCX/xXudzc:M27RJeDQzICqLJcEVdCX/xQzc
Score
10/10
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 39 IoCs
-
UPX dump on OEP (original entry point) 38 IoCs
-
UPX packed file 38 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 7 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 11 IoCs
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-04-23_10c3cb22ef88829ead39183ac57fc434_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-23_10c3cb22ef88829ead39183ac57fc434_icedid.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\etpyw.exeFilesize
100KB
MD5fd9bbf8a62ee993526633591a80a998f
SHA157d5eee922e28e56dd8662b128d7db66b009287b
SHA256f5a74cfade306893678e8108c30093a3634cd0fde7399cffd48808537ebcb0c8
SHA51238f77245818698a59ac586c19ec116cef1fba6858dc44c2a1d28a2e919f2038f5d156b609811def6391a6a6ea2068755ac893b448f8009b94ed140766ebcf512
-
memory/1032-26-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-5-0x0000000006680000-0x0000000006682000-memory.dmpFilesize
8KB
-
memory/1032-4-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-0-0x0000000000400000-0x000000000051B000-memory.dmpFilesize
1.1MB
-
memory/1032-6-0x00000000068D0000-0x00000000068D1000-memory.dmpFilesize
4KB
-
memory/1032-9-0x0000000006680000-0x0000000006682000-memory.dmpFilesize
8KB
-
memory/1032-8-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-10-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-11-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-12-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-13-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-14-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-15-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-16-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-17-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-28-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-19-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-21-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-22-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-23-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-68-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-3-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-18-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-30-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-33-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-35-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-36-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-37-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-39-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-46-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-48-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-50-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-52-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-54-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-56-0x0000000006680000-0x0000000006682000-memory.dmpFilesize
8KB
-
memory/1032-57-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-59-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-61-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-63-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-65-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-67-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-25-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB
-
memory/1032-1-0x0000000002330000-0x00000000033BE000-memory.dmpFilesize
16.6MB