Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 03:53
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe
Resource
win7-20240221-en
General
-
Target
2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe
-
Size
1.2MB
-
MD5
b6bd3510fe1ea53a485125851fe24689
-
SHA1
d922de471e1977714828b6a70258c449df945184
-
SHA256
a4ae317aaa5b27ca89de427fed5ce7b477d693690b1087ef4ad2f6733cc7bcb1
-
SHA512
3d3f8a3a10842a6197da9a77e17ef675293c413bbd87150f03d79a4c1edc50beb438621dc6b07e5a4ed283fae938c5b34069bb83e5583274438740219a0d560e
-
SSDEEP
24576:nNQqxk/LBaIt34ya0eKbQUMTAJPl++AJuoyUlztA8hxi:naqxkVaItIVUM2Pl+LVyynbi
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe -
Processes:
2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe -
Processes:
2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2324-2-0x0000000002060000-0x00000000030EE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2324-4-0x0000000002060000-0x00000000030EE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2324-10-0x0000000002060000-0x00000000030EE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2324-18-0x0000000002060000-0x00000000030EE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2324-5-0x0000000002060000-0x00000000030EE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2324-2-0x0000000002060000-0x00000000030EE000-memory.dmp UPX behavioral1/memory/2324-4-0x0000000002060000-0x00000000030EE000-memory.dmp UPX behavioral1/memory/2324-10-0x0000000002060000-0x00000000030EE000-memory.dmp UPX behavioral1/memory/2324-18-0x0000000002060000-0x00000000030EE000-memory.dmp UPX behavioral1/memory/2324-20-0x0000000000400000-0x0000000000568000-memory.dmp UPX behavioral1/memory/2324-5-0x0000000002060000-0x00000000030EE000-memory.dmp UPX -
Processes:
resource yara_rule behavioral1/memory/2324-2-0x0000000002060000-0x00000000030EE000-memory.dmp upx behavioral1/memory/2324-4-0x0000000002060000-0x00000000030EE000-memory.dmp upx behavioral1/memory/2324-10-0x0000000002060000-0x00000000030EE000-memory.dmp upx behavioral1/memory/2324-18-0x0000000002060000-0x00000000030EE000-memory.dmp upx behavioral1/memory/2324-5-0x0000000002060000-0x00000000030EE000-memory.dmp upx -
Processes:
2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe -
Processes:
2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe -
Drops file in Windows directory 1 IoCs
Processes:
2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exepid process 2324 2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exepid process 2324 2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe 2324 2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_b6bd3510fe1ea53a485125851fe24689_icedid.exe"1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\CCProxy.iniFilesize
38B
MD5ed7026cea323f38e3926a8d4c8298037
SHA164daa6d089a10e19e636a9ef5904aa7201229fa6
SHA2563f1870c2d18b9e2e1e696887b974d7030efacd66628c1e96c856d17844096b27
SHA5125e86aaabf531c1d3dd131766afa03b62d62b0bc75a6fdb6bc616f90ad02fb3d4b20eb9551c7a7c54e1923db6d85f950732e98c381838c095d13aa3aa76d54525
-
memory/2324-0-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/2324-2-0x0000000002060000-0x00000000030EE000-memory.dmpFilesize
16.6MB
-
memory/2324-4-0x0000000002060000-0x00000000030EE000-memory.dmpFilesize
16.6MB
-
memory/2324-10-0x0000000002060000-0x00000000030EE000-memory.dmpFilesize
16.6MB
-
memory/2324-18-0x0000000002060000-0x00000000030EE000-memory.dmpFilesize
16.6MB
-
memory/2324-20-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/2324-5-0x0000000002060000-0x00000000030EE000-memory.dmpFilesize
16.6MB