d3232127d66c3263a65d9f27a8bce78da5be65a5770e28835d347adc294616b9

General

Target
2024-04-26_19847afd82533461ce9e25b970629caf_icedid.exe
Size 1.8MB
Sample240426-dz9cfshe52
SHA256 d3232127d66c3263a65d9f27a8bce78da5be65a5770e28835d347adc294616b9
MD5 19847afd82533461ce9e25b970629caf
SHA1 156198b9fde9722708e83966cfbed9725bb383ae
SHA512 85885cd7c49cbec125744963df9b05c68fd819cee4da8c5b11072fb7cab57a75161ccecf17d8545c4596cfeb0098df7790b5d4b0c584e94f2f2a5fc53b97c996
SSDEEP 24576:kaVNwtAk1k3b2MrWvsD3Yn2IeYjGAK19iOCr+TMoO30mYn0YaAstHxM5GTroZzkR:3VNwS3bv60D3wZjG83V1T8Z/z2
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

Malware Config

Signatures

Detects executables packed with ASPack 5 IoCs

resource	yara_rule
behavioral2/files/0x001c00000001e97e-2.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2384-6-0x0000000010000000-0x000000001016D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2384-7-0x0000000010000000-0x000000001016D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2384-8-0x0000000010000000-0x000000001016D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2384-26-0x0000000010000000-0x000000001016D000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Blocklisted process makes network request 5 IoCs

flow	pid	Process
21	1364	rundll32.exe
93	1364	rundll32.exe
159	1364	rundll32.exe
287	1364	rundll32.exe
386	1364	rundll32.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.Net CLRX19\Parameters\ServiceDll = "C:\\Windows\\system32\\e572bb3.dll"	nt.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001c00000001e97e-2.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	nt.exe

Executes dropped EXE 1 IoCs

pid	Process
3648	nt.exe

Loads dropped DLL 4 IoCs

pid	Process
2384	2024-04-26_19847afd82533461ce9e25b970629caf_icedid.exe
3648	nt.exe
1972	svchost.exe
1364	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\e572bb3.dll	nt.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\nt.dll	2024-04-26_19847afd82533461ce9e25b970629caf_icedid.exe
File created	C:\Windows\nt.exe	2024-04-26_19847afd82533461ce9e25b970629caf_icedid.exe
File created	C:\Windows\EAy41dAd.dat	2024-04-26_19847afd82533461ce9e25b970629caf_icedid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2384	2024-04-26_19847afd82533461ce9e25b970629caf_icedid.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3648	nt.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2384	2024-04-26_19847afd82533461ce9e25b970629caf_icedid.exe
2384	2024-04-26_19847afd82533461ce9e25b970629caf_icedid.exe
2384	2024-04-26_19847afd82533461ce9e25b970629caf_icedid.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 3648	2384	2024-04-26_19847afd82533461ce9e25b970629caf_icedid.exe	86
PID 2384 wrote to memory of 3648	2384	2024-04-26_19847afd82533461ce9e25b970629caf_icedid.exe	86
PID 2384 wrote to memory of 3648	2384	2024-04-26_19847afd82533461ce9e25b970629caf_icedid.exe	86
PID 1972 wrote to memory of 1364	1972	svchost.exe	88
PID 1972 wrote to memory of 1364	1972	svchost.exe	88
PID 1972 wrote to memory of 1364	1972	svchost.exe	88
PID 3648 wrote to memory of 3788	3648	nt.exe	89
PID 3648 wrote to memory of 3788	3648	nt.exe	89
PID 3648 wrote to memory of 3788	3648	nt.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-04-26_19847afd82533461ce9e25b970629caf_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-26_19847afd82533461ce9e25b970629caf_icedid.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\nt.exe
  C:\Windows\nt.exe
  2⤵
  - Sets DLL path for service in the registry
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\nt.exe" > nul
    3⤵
    PID:3788

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k ".Net CLRX19"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe c:\windows\system32\e572bb3.dll, Launch
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:1364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e572bb3.dll

Path C:\Windows\SysWOW64\e572bb3.dll
Size 610KB
SHA256 3d05f22b748845a4fc4820804ffc59282f9210bfbda1b64cf813f8ac6ef055f6
MD5 272b346716ee47d806fd0026232cc152
SHA1 496f8a88152439769cc5692db9f32e46f4029fdd
SHA512 9292b29afb79cea26900b8ab111e285109fb022f102953e8cb281d91996a3486e67039539ec8cb532be91e83bd463bb91b432db0a52f5420b9ba88cd6ebb0c72
SSDEEP 12288:TjG/5NwYkK19iOCr+TMoO30mYn0YaAsGhQHxM5DKTrH5eZQ2Q:TjGAK19iOCr+TMoO30mYn0YaAstHxM5s
MD5 SHA1 SHA512 SSDEEP

Submit Download

nt.dll

Path C:\Windows\nt.dll
Size 1017KB
SHA256 87b47fea07efa522a00d6a7dc08cc7f93a75fc8ea647c2c9f4796d30f5ff8fd0
MD5 e7491ce1d0ac748e66c3355406d70666
SHA1 01716de4072273b17ca3b691d6e5518940e65374
SHA512 07dd4f3d638f05b4faeddb3b727169bf026565789b6e799a561f05b9508fff1f81cc0f2459657de385f63b5f2e6106ca1a0d600870362b0932c5a121bbe3597e
SSDEEP 24576:BYn2IeYjGAK19iOCr+TMoO30mYn0YaAstHxM5GTroZzkdG0:BwZjG83V1T8Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

nt.exe

Path C:\Windows\nt.exe
Size 658KB
SHA256 67cd2302d78063bbf7266baa48cbab9eafd72ca0a02d4b0b88bc8085a67359fb
MD5 34403f1ce4a948585ee28f09e3cbc4c1
SHA1 4536cef9720625b54f1879449c992b8fd75aecd3
SHA512 2cddf373aa1b0811d3cd8c4171ebb5d14ed58bd63b45be33f8c0b82b6c1288d460ed130338d0dc1f054bacb0e28f243d853a79efeac6285eb0bd06f70a52bd32
SSDEEP 12288:SaejG/5NwYkK19iOCr+TMoO30mYn0YaAsGhQHxM5DKTrH5eZQ2O:2jGAK19iOCr+TMoO30mYn0YaAstHxM5y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2384-0-0x0000000000C80000-0x0000000000C87000-memory.dmp

Download

memory/2384-6-0x0000000010000000-0x000000001016D000-memory.dmp

Download

memory/2384-7-0x0000000010000000-0x000000001016D000-memory.dmp

Download

memory/2384-8-0x0000000010000000-0x000000001016D000-memory.dmp

Download

memory/2384-26-0x0000000010000000-0x000000001016D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads