Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30-04-2024 00:57
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe
Resource
win7-20231129-en
General
-
Target
2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe
-
Size
396KB
-
MD5
adda015e886ad13a3fd8b247b67f4870
-
SHA1
a08a3f749758fb712692d87dfa16171ff6aac23b
-
SHA256
1591528a480f451786565f13395b38fb06933e15843b6c1d5a283ff480f9072c
-
SHA512
9482494ee1fbbe8ced4565bf60971c0bfab681bd3f6d1304c4a405b0b3ddf30fc5ed4105cf096837461698a44d85557e11038079f0614a8048d6000a106d3301
-
SSDEEP
6144:SdyUtua8mAkgfczyTZk2LLiuSGNSBXVRb9Pf08:Sdptu8gUeTBqpRb9x
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1364 IntimidateCulpable.exe 2068 IntimidateCulpable.exe -
Loads dropped DLL 4 IoCs
pid Process 2416 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe 2416 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe 2416 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe 2416 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification \??\f:\$recycle.bin\s-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini IntimidateCulpable.exe File opened for modification \??\f:\$recycle.bin\s-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini IntimidateCulpable.exe -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{D4B669E1-CDD4-2208-7A42-A045F4609710} regsvr32.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files\RueSelf-assertion\RueEnact.exe IntimidateCulpable.exe File opened for modification C:\Program Files\RueSelf-assertion\RueEnact.exe IntimidateCulpable.exe File opened for modification C:\Program Files\ScoreFumes\ScoreScore.exe IntimidateCulpable.exe File created C:\Program Files\ScoreFumes\ScoreScore.exe IntimidateCulpable.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\RVWVLYCAVB.dll 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 46 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2654C523-FB79-3EA1-CA99-745FAF63915A}\1.0\0\win32\ = "C:\\Windows\\RVWVLYCAVB.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4B669E1-CDD4-2208-7A42-A045F4609710}\ = "xunlei Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4B669E1-CDD4-2208-7A42-A045F4609710}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2654C523-FB79-3EA1-CA99-745FAF63915A}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2654C523-FB79-3EA1-CA99-745FAF63915A}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei.1\ = "xunlei Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4B669E1-CDD4-2208-7A42-A045F4609710}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4B669E1-CDD4-2208-7A42-A045F4609710}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2654C523-FB79-3EA1-CA99-745FAF63915A}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\ = "Ixunlei" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\ = "Ixunlei" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\TypeLib\ = "{2654C523-FB79-3EA1-CA99-745FAF63915A}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei\CLSID\ = "{D4B669E1-CDD4-2208-7A42-A045F4609710}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4B669E1-CDD4-2208-7A42-A045F4609710}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei\ = "xunlei Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2654C523-FB79-3EA1-CA99-745FAF63915A}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2654C523-FB79-3EA1-CA99-745FAF63915A} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2654C523-FB79-3EA1-CA99-745FAF63915A}\1.0\ = "Thunder 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei.1\CLSID\ = "{D4B669E1-CDD4-2208-7A42-A045F4609710}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4B669E1-CDD4-2208-7A42-A045F4609710}\VersionIndependentProgID\ = "Thunder.xunlei" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2654C523-FB79-3EA1-CA99-745FAF63915A}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei\CurVer\ = "Thunder.xunlei.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4B669E1-CDD4-2208-7A42-A045F4609710} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2654C523-FB79-3EA1-CA99-745FAF63915A}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2654C523-FB79-3EA1-CA99-745FAF63915A}\1.0\HELPDIR\ = "C:\\Windows" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4B669E1-CDD4-2208-7A42-A045F4609710}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4B669E1-CDD4-2208-7A42-A045F4609710}\InprocServer32\ = "C:\\Windows\\RVWVLYCAVB.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4B669E1-CDD4-2208-7A42-A045F4609710}\TypeLib\ = "{2654C523-FB79-3EA1-CA99-745FAF63915A}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\TypeLib\ = "{2654C523-FB79-3EA1-CA99-745FAF63915A}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4B669E1-CDD4-2208-7A42-A045F4609710}\ProgID\ = "Thunder.xunlei.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4B669E1-CDD4-2208-7A42-A045F4609710}\TypeLib regsvr32.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 2416 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe 2416 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe 2416 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe 2416 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe 2416 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe 1364 IntimidateCulpable.exe 1364 IntimidateCulpable.exe 2068 IntimidateCulpable.exe 2068 IntimidateCulpable.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2416 wrote to memory of 1704 2416 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe 28 PID 2416 wrote to memory of 1704 2416 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe 28 PID 2416 wrote to memory of 1704 2416 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe 28 PID 2416 wrote to memory of 1704 2416 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe 28 PID 2416 wrote to memory of 1704 2416 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe 28 PID 2416 wrote to memory of 1704 2416 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe 28 PID 2416 wrote to memory of 1704 2416 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe 28 PID 2416 wrote to memory of 1364 2416 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe 29 PID 2416 wrote to memory of 1364 2416 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe 29 PID 2416 wrote to memory of 1364 2416 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe 29 PID 2416 wrote to memory of 1364 2416 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe 29 PID 2416 wrote to memory of 2068 2416 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe 30 PID 2416 wrote to memory of 2068 2416 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe 30 PID 2416 wrote to memory of 2068 2416 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe 30 PID 2416 wrote to memory of 2068 2416 2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_adda015e886ad13a3fd8b247b67f4870_icedid.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Windows\RVWVLYCAVB.dll"2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1704
-
-
C:\Users\Admin\AppData\Local\Temp\IntimidateCulpable.exe"C:\Users\Admin\AppData\Local\Temp\IntimidateCulpable.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1364
-
-
C:\Users\Admin\AppData\Local\Temp\IntimidateCulpable.exeC:\Users\Admin\AppData\Local\Temp\IntimidateCulpable.exe2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
396KB
MD5adda015e886ad13a3fd8b247b67f4870
SHA1a08a3f749758fb712692d87dfa16171ff6aac23b
SHA2561591528a480f451786565f13395b38fb06933e15843b6c1d5a283ff480f9072c
SHA5129482494ee1fbbe8ced4565bf60971c0bfab681bd3f6d1304c4a405b0b3ddf30fc5ed4105cf096837461698a44d85557e11038079f0614a8048d6000a106d3301
-
Filesize
428KB
MD5d056ff56318dc13d323374f50b03492f
SHA1e7e06cfa6df17d38cfb847062c05364e4c756c0f
SHA2562334098c7a9bfa26b9ea90f3fb06a9dc006b5d2149d1b392da144bb712c23d46
SHA5127e149e35185a616d1dab06c79bffffd092ce851bfd3cd33fa613e34c3dc613f12f3c2168264d5d12e1384dc3b9ac58a5ff3010ff1de9e250cc4fa3c777b145ec
-
Filesize
28KB
MD5927476200feeb6160af47839940f10cc
SHA177dbd1d864d608a59fe5be14c10df1682de40486
SHA2567f3bcfae359fce0e86d1f0b8881d204b3f4bea37b993c06d8a42d3771d92c2da
SHA51242e9c462242865567d1b5429d45b561535c1fd732ba62ef1c773e8f446663adb5cf81bf27c3dee16458f1e56397911ba0d1b54db372f619f536e2161c1121c9f