Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 09:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe
Resource
win7-20231129-en
General
-
Target
2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe
-
Size
284KB
-
MD5
43375d4430f8aa4e3808c2874c18ceb8
-
SHA1
73f25b3fed49577de9afa111421705188a48dc31
-
SHA256
d9a821f39c7a139971a5db14603c7683b7227b597ccf58e32aecd022d04b421d
-
SHA512
b102eea1824af104dacbb56d25de7474fce9aeaecfc0094660f197913babb6422270f9f465f62074bf1e601defdb6f84e76d8f317403a4b91174dfb3b4449b81
-
SSDEEP
6144:plDx7mlcAZBcIdqkorDfoR/0C1fzDB9ePHSJ:plDx7mlHZo7HoRv177ePH
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
sethome3189.exepid process 2628 sethome3189.exe -
Loads dropped DLL 2 IoCs
Processes:
2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exepid process 2188 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe 2188 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Windows directory 2 IoCs
Processes:
2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exedescription ioc process File created \??\c:\windows\system\sethome3189.exe 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe File opened for modification \??\c:\windows\system\sethome3189.exe 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer start page 1 TTPs 1 IoCs
Processes:
2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.baiduo.org/" 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exepid process 2188 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exesethome3189.exepid process 2188 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe 2188 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe 2188 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe 2188 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe 2628 sethome3189.exe 2628 sethome3189.exe 2628 sethome3189.exe 2628 sethome3189.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exedescription pid process target process PID 2188 wrote to memory of 2628 2188 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe sethome3189.exe PID 2188 wrote to memory of 2628 2188 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe sethome3189.exe PID 2188 wrote to memory of 2628 2188 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe sethome3189.exe PID 2188 wrote to memory of 2628 2188 2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe sethome3189.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_43375d4430f8aa4e3808c2874c18ceb8_icedid.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\windows\system\sethome3189.exec:\windows\system\sethome3189.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2628
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\abc.lnkFilesize
965B
MD5ce722ef9a86c59126c4245462fc403dd
SHA1de7168f484c16f0d5eaaaa6eb779245c8eba54c5
SHA2566f45cadf35df8b4cfb611be0bf7ffb8078eb6a9ab51897cd594b6aad0a0e9f06
SHA512fc6486158b9bf375172c339035292242997efbd654d0002a0e7015d66101c72f3a8a72efdcd37a0f8d9850ef18bc6aa97690e9248e486d9569beb65e034a4afc
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnkFilesize
1KB
MD57e4005160fe38daec6d307dae727b4ee
SHA1db1b76470f8278a5c79974ab3d503d54e58d8afd
SHA2567856bfb6f781fe5d18fb1558f17684a8e820edd62afda716b2e8547656f5b4b7
SHA512a84a1a783ecbf08fb1872096467c4c79ee2e429330137a67704f8fe0186f5330567ee266e61f76697ef32e45f8e8f7d9732c6b38618d056bf399652966234b15
-
C:\Users\abc.lnkFilesize
1KB
MD5eb87efe8c0c062e31fd384fd4afa9c3f
SHA124dcb9b16c5b0b22a6cd6bf66944006648d1d768
SHA256884c07982837c3b640fa09900e00d686dbc39f0f870aacc76eda2c9c6413efca
SHA512291ab8fb55880e2ad10a0dcb0ca3b4bdd643fdb09703902f6d7ac217f54a118d5b6d2a86564e58d0cd3f050fe8e900e260678937975bc6c115b1d24d0f754088
-
\Windows\system\sethome3189.exeFilesize
284KB
MD543f10b350d32fe28f2526ff5d449e6f4
SHA197fc6e15567521d634b8641bea42952caf1bf46f
SHA2561b4e74904c081d488180adb5c07ded422083e6b6fa4cd67c54400ed8a53f0dad
SHA5125790d265f203aeb7db22fa3c6760022fcb246e1f5760e088e13035affe1dbc0a2ff71bf0f10fa0816cc5335e25ae1eaae578613aee4d10fa0741d6729d610bf1