Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 20:48
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-28_5c96689f754ca1130c2f40142abbf53f_icedid.exe
Resource
win7-20240220-en
General
-
Target
2024-04-28_5c96689f754ca1130c2f40142abbf53f_icedid.exe
-
Size
729KB
-
MD5
5c96689f754ca1130c2f40142abbf53f
-
SHA1
ec49f26d537a0090dbdb284fa899905c9427f2e7
-
SHA256
2cf71056d03d67ac7d43dc7a9eaf07a22d31652bb60321b19f7bbcfbd24fd4c9
-
SHA512
d720dd796ccb41932f41512b32fe507933429bcf160d253ef647c806122e2535bcfd86011284a72ff1517747a0271b678dc3bbcd3f09d067406fb275db6bbed9
-
SSDEEP
12288:lij4VFDC3X3y7PX0rI65PtN7AGF26o5HpZgLcqiz9BKbzXvPejDTRnG:lijWL65PoGF2HJ6Zy9BGDODT
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
120A.tmppid process 760 120A.tmp -
Loads dropped DLL 2 IoCs
Processes:
2024-04-28_5c96689f754ca1130c2f40142abbf53f_icedid.exepid process 840 2024-04-28_5c96689f754ca1130c2f40142abbf53f_icedid.exe 840 2024-04-28_5c96689f754ca1130c2f40142abbf53f_icedid.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
Processes:
120A.tmpdescription ioc process File created C:\Windows\SysWOW64\msexch40.dll 120A.tmp File created C:\Windows\SysWOW64\msjet40.dll 120A.tmp File created C:\Windows\SysWOW64\sqlwoa.dll 120A.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\amdpcom32.dll 120A.tmp File opened for modification C:\Windows\SysWOW64\mfc100.dll 120A.tmp File opened for modification C:\Windows\SysWOW64\mfc120.dll 120A.tmp File opened for modification C:\Windows\SysWOW64\msvcr110.dll 120A.tmp File created C:\Windows\SysWOW64\mfc40.dll 120A.tmp File created C:\Windows\SysWOW64\setupSNK.exe 120A.tmp File opened for modification C:\Windows\SysWOW64\concrt140.dll 120A.tmp File created C:\Windows\SysWOW64\msjter40.dll 120A.tmp File created C:\Windows\SysWOW64\msrepl40.dll 120A.tmp File created C:\Windows\SysWOW64\mspbde40.dll 120A.tmp File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 120A.tmp File created C:\Windows\SysWOW64\d3d8.dll 120A.tmp File created C:\Windows\SysWOW64\d3dim700.dll 120A.tmp File opened for modification C:\Windows\SysWOW64\mfc120u.dll 120A.tmp File created C:\Windows\SysWOW64\d3dxof.dll 120A.tmp File opened for modification C:\Windows\SysWOW64\mfc110u.dll 120A.tmp File created C:\Windows\SysWOW64\expsrv.dll 120A.tmp File opened for modification C:\Windows\SysWOW64\mfc140u.dll 120A.tmp File created C:\Windows\SysWOW64\olecli32.dll 120A.tmp File created C:\Windows\SysWOW64\mswstr10.dll 120A.tmp File created C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igdumd32.dll 120A.tmp File created C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\nvd3dum.dll 120A.tmp File created C:\Windows\SysWOW64\migration\MediaPlayer-DLMigPlugin.dll 120A.tmp File created C:\Windows\SysWOW64\audiodev.dll 120A.tmp File created C:\Windows\SysWOW64\ir50_32.dll 120A.tmp File created C:\Windows\SysWOW64\msjtes40.dll 120A.tmp File created C:\Windows\SysWOW64\msorcl32.dll 120A.tmp File opened for modification C:\Windows\SysWOW64\msvcr120_clr0400.dll 120A.tmp File created C:\Windows\SysWOW64\msvcrt20.dll 120A.tmp File created C:\Windows\SysWOW64\regedit.exe 120A.tmp File opened for modification C:\Windows\SysWOW64\VBAME.DLL 120A.tmp File created C:\Windows\SysWOW64\d3dim.dll 120A.tmp File created C:\Windows\SysWOW64\ir32_32.dll 120A.tmp File opened for modification C:\Windows\SysWOW64\mfc100u.dll 120A.tmp File opened for modification C:\Windows\SysWOW64\vcomp140.dll 120A.tmp File created C:\Windows\SysWOW64\dmscript.dll 120A.tmp File created C:\Windows\SysWOW64\msvbvm60.dll 120A.tmp File created C:\Windows\SysWOW64\mswdat10.dll 120A.tmp File created C:\Windows\SysWOW64\ivfsrc.ax 120A.tmp File created C:\Windows\SysWOW64\mfc40u.dll 120A.tmp File created C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igd10umd32.dll 120A.tmp File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-MediaPlayer\MediaPlayer-DLMigPlugin.dll 120A.tmp File opened for modification C:\Windows\SysWOW64\atl100.dll 120A.tmp File created C:\Windows\SysWOW64\crtdll.dll 120A.tmp File created C:\Windows\SysWOW64\dplayx.dll 120A.tmp File created C:\Windows\SysWOW64\msxbde40.dll 120A.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdag.dll 120A.tmp File created C:\Windows\SysWOW64\InstallShield\setup.exe 120A.tmp File created C:\Windows\SysWOW64\explorer.exe 120A.tmp File opened for modification C:\Windows\SysWOW64\mfc110.dll 120A.tmp File opened for modification C:\Windows\SysWOW64\mfc140.dll 120A.tmp File created C:\Windows\SysWOW64\msexcl40.dll 120A.tmp File opened for modification C:\Windows\SysWOW64\msvcr120.dll 120A.tmp File created C:\Windows\SysWOW64\sqlunirl.dll 120A.tmp File created C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\nvwgf2um.dll 120A.tmp File opened for modification C:\Windows\SysWOW64\atl110.dll 120A.tmp File created C:\Windows\SysWOW64\dpwsockx.dll 120A.tmp File created C:\Windows\SysWOW64\ir41_32.ax 120A.tmp File created C:\Windows\SysWOW64\msrd3x40.dll 120A.tmp File created C:\Windows\SysWOW64\mstext40.dll 120A.tmp File opened for modification C:\Windows\SysWOW64\msvcr100.dll 120A.tmp -
Drops file in Program Files directory 64 IoCs
Processes:
120A.tmpdescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\Synchronization.dll 120A.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCL.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXEV.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe 120A.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EMABLT32.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe 120A.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeUpdater.dll 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnvpxy.dll 120A.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Onix32.dll 120A.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annots.api 120A.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACETXT.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OWSCLT.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODBC.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GKExcel.dll 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHEVI.DLL 120A.tmp File opened for modification C:\Program Files\7-Zip\Uninstall.exe 120A.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FBIBLIO.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GFX.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCNPST64.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe 120A.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\MSB1XTOR.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdate.dll 120A.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\PNG32.FLT 120A.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACERCLR.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7tkjp.dll 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EMSMDB32.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RECALL.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\IA32.api 120A.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\JPEGIM32.FLT 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\DLGSETP.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MLSHEXT.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLVBS.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DBGHELP.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEAWSDC.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MCPS.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\MOFL.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\FPSRVUTL.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ENVELOPE.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONMAIN.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll 120A.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE 120A.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Portal\PortalConnectCore.dll 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\FeedSync.dll 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SOA.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7FR.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSTH7ES.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\xmlrwbin.dll 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSODCW.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PTXT9.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\TWCUTCHR.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE 120A.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\weblink.api 120A.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACER3X.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe 120A.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE 120A.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\EPSIMP32.FLT 120A.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONTAB32.DLL 120A.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VC\msdia100.dll 120A.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe 120A.tmp -
Drops file in Windows directory 64 IoCs
Processes:
120A.tmpdescription ioc process File created C:\Windows\winsxs\x86_microsoft-windows-directx-directdraw_31bf3856ad364e35_6.1.7600.16385_none_04dbf9102154d42e\ddrawex.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-wmspdmoe_31bf3856ad364e35_6.1.7600.16385_none_f9fb55c5d138e6cb\WMSPDMOE.DLL 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-d..japanese-propertyui_31bf3856ad364e35_6.1.7600.16385_none_929776facb7f4f74\imjputyc.dll 120A.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-usp_31bf3856ad364e35_6.1.7601.17514_none_af01e2f9b6be7939_usp10.dll_8785b649 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-crypt32-dll_31bf3856ad364e35_6.1.7601.17514_none_5d772bc73c15dfe5\crypt32.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-i..nternetcontrolpanel_31bf3856ad364e35_11.2.9600.16428_none_15721d9aae8950e7\inetcpl.cpl 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_8.0.7600.16385_none_7f0c7a3c17077fce\wextract.exe 120A.tmp File created C:\Windows\winsxs\amd64_nv_lh.inf_31bf3856ad364e35_6.1.7600.16385_none_4a5c7d78e486512b\nvwgf2um.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-c..complus-runtime-qfe_31bf3856ad364e35_6.1.7600.16385_none_6b3984a4d9e2684a\catsrv.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-d..ellman_software_csp_31bf3856ad364e35_6.1.7600.16385_none_3bcf11a6e63842c7\dssenh.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..components-jetexcel_31bf3856ad364e35_6.1.7600.16385_none_1de500b1a390aab9\msexcl40.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..mponents-jetintlerr_31bf3856ad364e35_6.1.7600.16385_none_0f472a3521bdcfd4\mswdat10.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.4148_none_4bf5400abf9d60b7\mfc90u.dll 120A.tmp File created C:\Windows\winsxs\x86_netfx-clr_sys_entservcs_thunk_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_26e756d174266d3a\System.EnterpriseServices.Thunk.dll 120A.tmp File created C:\Windows\winsxs\x86_netfx-mscordbc_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_414c2fe8825bd6cb\mscordbc.dll 120A.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-w..owsupdateclient-aux_31bf3856ad364e35_7.5.7601.17514_none_0f99f84e0e6e2bc3\wuapi.dll 120A.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17514_none_96780994e42bbfd5\mshtml.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-rasrtutils_31bf3856ad364e35_6.1.7601.17514_none_0f1cfdfc48bca8a8\rtutils.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_0b66cb34258c936f\cmitrust.dll 120A.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlediting_31bf3856ad364e35_11.2.9600.16428_none_34d4a6c78cd3b895\mshtmled.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-winlogon-sas_31bf3856ad364e35_6.1.7600.16385_none_794ca3c3dba3387a\sas.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..s-mdac-odbcconf-dll_31bf3856ad364e35_6.1.7601.17514_none_09e055945403c2af\odbcconf.dll 120A.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-object-picker_31bf3856ad364e35_6.1.7600.16385_none_0f6c30b96de81257_objsel.dll_9d6ddd89 120A.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-w..pdateclient-activex_31bf3856ad364e35_7.5.7601.17514_none_b9a4b88eb4255dbf\wuapp.exe 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_6.1.7601.17514_none_c82fdb5265bc18af\SndVolSSO.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-directwrite_31bf3856ad364e35_6.1.7601.17514_none_d4a4d90d5db128bf\DWrite.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..-downlevelmanifests_31bf3856ad364e35_6.1.7601.17514_none_04801f69e1dbd8e6\adfsmig.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_6.1.7600.16385_none_ed38f66d69c578dc\virtdisk.dll 120A.tmp File created C:\Windows\winsxs\x86_presentationcore_31bf3856ad364e35_6.1.7601.17514_none_ae387c2aee366287\wpfgfx_v0300.dll 120A.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-ldap-client_31bf3856ad364e35_6.1.7601.17514_none_f543b182b4adcce6_wldap32.dll_09c99dc1 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-setup-support_31bf3856ad364e35_8.0.7601.17514_none_e292664733bd5af6\iernonce.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-msvcrt20_31bf3856ad364e35_6.1.7600.16385_none_edfa3292d2258f2c\msvcrt20.dll 120A.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-i..mlrenderingadvanced_31bf3856ad364e35_8.0.7601.17514_none_63fa9d9d3e74ef7b\mstime.dll 120A.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\iisreset.exe 120A.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_6.1.7601.17514_none_04846decebf43c4c\pdhui.dll 120A.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-syncinfrastructure_31bf3856ad364e35_6.1.7600.16385_none_f838d0115142247e\SyncInfrastructure.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-installer-executable_31bf3856ad364e35_6.1.7601.17514_none_4b88deb7e45bfbb0\msiexec.exe 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-n..n_service_migplugin_31bf3856ad364e35_6.1.7600.16385_none_5e24e56caba0b429\IasMigPlugin.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.4148_none_4bf5400abf9d60b7\mfc90.dll 120A.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-b..sscanning-smcnative_31bf3856ad364e35_6.1.7600.16385_none_e6ccfcfcd8f1f934\SMCNative.dll 120A.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-htmlhelp_31bf3856ad364e35_6.1.7600.16385_none_2e9f92abd2ce43b6\hhsetup.dll 120A.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-netbt_31bf3856ad364e35_6.1.7601.17514_none_c8df7823424473a1\netbtugc.exe 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-netprofui_31bf3856ad364e35_6.1.7600.16385_none_9a88b93668ba0cef\netprof.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-sxs_31bf3856ad364e35_6.1.7601.17514_none_b0540607b5e5d445\SxsMigPlugin.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-usbui_31bf3856ad364e35_6.1.7600.16385_none_5b256c1b0e32752b\usbui.dll 120A.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-font-embedding_31bf3856ad364e35_6.1.7601.17514_none_b7c78d327d35e10e_t2embed.dll_66e8486f 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..simple-provider-dll_31bf3856ad364e35_6.1.7601.17514_none_c19889be2334c5b4\msdaosp.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-regini_31bf3856ad364e35_6.1.7600.16385_none_0c2c92921b2478ef\regini.exe 120A.tmp File created C:\Windows\winsxs\x86_netfx-ado_net_diag_b03f5f7f11d50a3a_6.1.7600.16385_none_41e26933a436d37d\AdoNetDiag.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..nents-mdac-ado15-rh_31bf3856ad364e35_6.1.7600.16385_none_33ac69f3afeb0325\msadrh15.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-deployment_31bf3856ad364e35_6.1.7601.17514_none_fdf660b64b901b2e\setupugc.exe 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_6.1.7601.17514_none_f20ae427dbae4faf\ntprint.exe 120A.tmp File created C:\Windows\winsxs\x86_wpf-presentationhostproxy_31bf3856ad364e35_6.2.7601.17514_none_f4c14ddc76dc8f97\PresentationHostProxy.dll 120A.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_6.1.7601.17514_none_32e02520f8081891\WsmWmiPl.dll 120A.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-directx-directdraw_31bf3856ad364e35_6.1.7600.16385_none_04dbf9102154d42e_ddrawex.dll_2aa2f829 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-advapi32_31bf3856ad364e35_6.1.7601.17514_none_e54fbb95e4c3d1bb\advapi32.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-mfwmaaec_31bf3856ad364e35_6.1.7600.16385_none_941cd80f95b75396\MFWMAAEC.DLL 120A.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ncrypt-dll_31bf3856ad364e35_6.1.7600.16385_none_5db4abb552efa414\ncrypt.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\cmiv2.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.1.7601.17514_none_94395a96e7042cf4\avicap32.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..-odbc-installer-dll_31bf3856ad364e35_6.1.7601.17514_none_8f326e5fb376d9c0\odbccp32.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-htmlhelp-infotech_31bf3856ad364e35_6.1.7601.17514_none_f8ab56ff71fc562a\itircl.dll 120A.tmp File created C:\Windows\winsxs\x86_microsoft-windows-packagemanager_31bf3856ad364e35_6.1.7601.17514_none_eedf2e0751865eb2\PkgMgr.exe 120A.tmp -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
2024-04-28_5c96689f754ca1130c2f40142abbf53f_icedid.exepid process 840 2024-04-28_5c96689f754ca1130c2f40142abbf53f_icedid.exe 840 2024-04-28_5c96689f754ca1130c2f40142abbf53f_icedid.exe 840 2024-04-28_5c96689f754ca1130c2f40142abbf53f_icedid.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-04-28_5c96689f754ca1130c2f40142abbf53f_icedid.exedescription pid process target process PID 840 wrote to memory of 760 840 2024-04-28_5c96689f754ca1130c2f40142abbf53f_icedid.exe 120A.tmp PID 840 wrote to memory of 760 840 2024-04-28_5c96689f754ca1130c2f40142abbf53f_icedid.exe 120A.tmp PID 840 wrote to memory of 760 840 2024-04-28_5c96689f754ca1130c2f40142abbf53f_icedid.exe 120A.tmp PID 840 wrote to memory of 760 840 2024-04-28_5c96689f754ca1130c2f40142abbf53f_icedid.exe 120A.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_5c96689f754ca1130c2f40142abbf53f_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_5c96689f754ca1130c2f40142abbf53f_icedid.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\120A.tmpC:\Users\Admin\AppData\Local\Temp\120A.tmp2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\120A.tmpFilesize
145KB
MD5c610e7ccd6859872c585b2a85d7dc992
SHA1362b3d4b72e3add687c209c79b500b7c6a246d46
SHA25614063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041
SHA5128570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666
-
C:\Users\Admin\AppData\Local\Temp\AdobeARM.logFilesize
148B
MD54d4a830cc3153198bf99f1a5f300a063
SHA1332803275a342d967cfcb8297d337abd55184531
SHA256f6e6b5bd434e730d25919e4d2f0aac65335a9f1a74275291b58687d71a9f2dc7
SHA5129705a308ce582015d8424fe4ce03fa32f95e4eb48191203b3a3e415aa2454a59b479d3a4261461729a615707e89967c3814cf5b9cf6e0c102ccc44aa8127efb8
-
memory/840-0-0x00000000002E0000-0x0000000000331000-memory.dmpFilesize
324KB
-
memory/840-1-0x00000000002E0000-0x0000000000331000-memory.dmpFilesize
324KB