Analysis
-
max time kernel
28s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 14:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe
Resource
win7-20240221-en
General
-
Target
2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe
-
Size
1.8MB
-
MD5
22c3b92d4a7b00c09b9a01dc41c5484f
-
SHA1
a68380980141c691745c3079b84269a7fc571a79
-
SHA256
13c4cb31e54f93e0a642d03cfec51b59c1f99a735b82771e60d0c309d4fda40a
-
SHA512
bf7fd781ca0d30849989e633a1d94ac3899b9e07014affde0140002ea001f0817230ccd61803c93620879d8eb764b1d3e723bbac6e37bbf4ae73295edac0ee51
-
SSDEEP
49152:2BHTZQBIGoA5nN9615Z9VTNIeUOPI5E33uLkv4:2JZgoiN9615YeUfauYv4
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
ireA.exe2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" ireA.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" ireA.exe -
Processes:
ireA.exe2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe -
Processes:
2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exeireA.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ireA.exe -
Detects executables packed with ASPack 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3248-22-0x0000000000250000-0x0000000000259000-memory.dmp INDICATOR_EXE_Packed_ASPack C:\Users\Admin\AppData\Local\Temp\ireA.exe INDICATOR_EXE_Packed_ASPack behavioral2/memory/3248-51-0x0000000000250000-0x0000000000259000-memory.dmp INDICATOR_EXE_Packed_ASPack -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 36 IoCs
Processes:
resource yara_rule behavioral2/memory/3144-3-0x00000000024B0000-0x000000000353E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3144-8-0x00000000024B0000-0x000000000353E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3144-9-0x00000000024B0000-0x000000000353E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3144-23-0x00000000024B0000-0x000000000353E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3144-16-0x00000000024B0000-0x000000000353E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3144-19-0x00000000024B0000-0x000000000353E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3144-32-0x00000000024B0000-0x000000000353E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3144-24-0x00000000024B0000-0x000000000353E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3144-7-0x00000000024B0000-0x000000000353E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3144-4-0x00000000024B0000-0x000000000353E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3144-1-0x00000000024B0000-0x000000000353E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3248-60-0x0000000005E70000-0x0000000006EFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3248-59-0x0000000005E70000-0x0000000006EFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3248-54-0x0000000005E70000-0x0000000006EFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3248-55-0x0000000005E70000-0x0000000006EFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3248-61-0x0000000005E70000-0x0000000006EFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3248-58-0x0000000005E70000-0x0000000006EFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3248-57-0x0000000005E70000-0x0000000006EFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3248-62-0x0000000005E70000-0x0000000006EFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3248-56-0x0000000005E70000-0x0000000006EFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3248-63-0x0000000005E70000-0x0000000006EFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3248-64-0x0000000005E70000-0x0000000006EFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3248-65-0x0000000005E70000-0x0000000006EFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3248-69-0x0000000005E70000-0x0000000006EFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3248-70-0x0000000005E70000-0x0000000006EFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3248-88-0x0000000005E70000-0x0000000006EFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3248-89-0x0000000005E70000-0x0000000006EFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3248-92-0x0000000005E70000-0x0000000006EFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3248-93-0x0000000005E70000-0x0000000006EFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3248-94-0x0000000005E70000-0x0000000006EFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3248-104-0x0000000005E70000-0x0000000006EFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3248-107-0x0000000005E70000-0x0000000006EFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3248-109-0x0000000005E70000-0x0000000006EFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3248-112-0x0000000005E70000-0x0000000006EFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3248-113-0x0000000005E70000-0x0000000006EFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3248-123-0x0000000005E70000-0x0000000006EFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 37 IoCs
Processes:
resource yara_rule behavioral2/memory/3144-3-0x00000000024B0000-0x000000000353E000-memory.dmp UPX behavioral2/memory/3144-8-0x00000000024B0000-0x000000000353E000-memory.dmp UPX behavioral2/memory/3144-9-0x00000000024B0000-0x000000000353E000-memory.dmp UPX behavioral2/memory/3144-23-0x00000000024B0000-0x000000000353E000-memory.dmp UPX behavioral2/memory/3144-16-0x00000000024B0000-0x000000000353E000-memory.dmp UPX behavioral2/memory/3144-19-0x00000000024B0000-0x000000000353E000-memory.dmp UPX behavioral2/memory/3144-32-0x00000000024B0000-0x000000000353E000-memory.dmp UPX behavioral2/memory/3144-24-0x00000000024B0000-0x000000000353E000-memory.dmp UPX behavioral2/memory/3144-37-0x0000000000400000-0x00000000005CB000-memory.dmp UPX behavioral2/memory/3144-7-0x00000000024B0000-0x000000000353E000-memory.dmp UPX behavioral2/memory/3144-4-0x00000000024B0000-0x000000000353E000-memory.dmp UPX behavioral2/memory/3144-1-0x00000000024B0000-0x000000000353E000-memory.dmp UPX behavioral2/memory/3248-60-0x0000000005E70000-0x0000000006EFE000-memory.dmp UPX behavioral2/memory/3248-59-0x0000000005E70000-0x0000000006EFE000-memory.dmp UPX behavioral2/memory/3248-54-0x0000000005E70000-0x0000000006EFE000-memory.dmp UPX behavioral2/memory/3248-55-0x0000000005E70000-0x0000000006EFE000-memory.dmp UPX behavioral2/memory/3248-61-0x0000000005E70000-0x0000000006EFE000-memory.dmp UPX behavioral2/memory/3248-58-0x0000000005E70000-0x0000000006EFE000-memory.dmp UPX behavioral2/memory/3248-57-0x0000000005E70000-0x0000000006EFE000-memory.dmp UPX behavioral2/memory/3248-62-0x0000000005E70000-0x0000000006EFE000-memory.dmp UPX behavioral2/memory/3248-56-0x0000000005E70000-0x0000000006EFE000-memory.dmp UPX behavioral2/memory/3248-63-0x0000000005E70000-0x0000000006EFE000-memory.dmp UPX behavioral2/memory/3248-64-0x0000000005E70000-0x0000000006EFE000-memory.dmp UPX behavioral2/memory/3248-65-0x0000000005E70000-0x0000000006EFE000-memory.dmp UPX behavioral2/memory/3248-69-0x0000000005E70000-0x0000000006EFE000-memory.dmp UPX behavioral2/memory/3248-70-0x0000000005E70000-0x0000000006EFE000-memory.dmp UPX behavioral2/memory/3248-88-0x0000000005E70000-0x0000000006EFE000-memory.dmp UPX behavioral2/memory/3248-89-0x0000000005E70000-0x0000000006EFE000-memory.dmp UPX behavioral2/memory/3248-92-0x0000000005E70000-0x0000000006EFE000-memory.dmp UPX behavioral2/memory/3248-93-0x0000000005E70000-0x0000000006EFE000-memory.dmp UPX behavioral2/memory/3248-94-0x0000000005E70000-0x0000000006EFE000-memory.dmp UPX behavioral2/memory/3248-104-0x0000000005E70000-0x0000000006EFE000-memory.dmp UPX behavioral2/memory/3248-107-0x0000000005E70000-0x0000000006EFE000-memory.dmp UPX behavioral2/memory/3248-109-0x0000000005E70000-0x0000000006EFE000-memory.dmp UPX behavioral2/memory/3248-112-0x0000000005E70000-0x0000000006EFE000-memory.dmp UPX behavioral2/memory/3248-113-0x0000000005E70000-0x0000000006EFE000-memory.dmp UPX behavioral2/memory/3248-123-0x0000000005E70000-0x0000000006EFE000-memory.dmp UPX -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\ireA.exe aspack_v212_v242 -
Deletes itself 1 IoCs
Processes:
ireA.exepid process 3248 ireA.exe -
Executes dropped EXE 1 IoCs
Processes:
ireA.exepid process 3248 ireA.exe -
Processes:
resource yara_rule behavioral2/memory/3144-3-0x00000000024B0000-0x000000000353E000-memory.dmp upx behavioral2/memory/3144-8-0x00000000024B0000-0x000000000353E000-memory.dmp upx behavioral2/memory/3144-9-0x00000000024B0000-0x000000000353E000-memory.dmp upx behavioral2/memory/3144-23-0x00000000024B0000-0x000000000353E000-memory.dmp upx behavioral2/memory/3144-16-0x00000000024B0000-0x000000000353E000-memory.dmp upx behavioral2/memory/3144-19-0x00000000024B0000-0x000000000353E000-memory.dmp upx behavioral2/memory/3144-32-0x00000000024B0000-0x000000000353E000-memory.dmp upx behavioral2/memory/3144-24-0x00000000024B0000-0x000000000353E000-memory.dmp upx behavioral2/memory/3144-7-0x00000000024B0000-0x000000000353E000-memory.dmp upx behavioral2/memory/3144-4-0x00000000024B0000-0x000000000353E000-memory.dmp upx behavioral2/memory/3144-1-0x00000000024B0000-0x000000000353E000-memory.dmp upx behavioral2/memory/3248-60-0x0000000005E70000-0x0000000006EFE000-memory.dmp upx behavioral2/memory/3248-59-0x0000000005E70000-0x0000000006EFE000-memory.dmp upx behavioral2/memory/3248-54-0x0000000005E70000-0x0000000006EFE000-memory.dmp upx behavioral2/memory/3248-55-0x0000000005E70000-0x0000000006EFE000-memory.dmp upx behavioral2/memory/3248-61-0x0000000005E70000-0x0000000006EFE000-memory.dmp upx behavioral2/memory/3248-58-0x0000000005E70000-0x0000000006EFE000-memory.dmp upx behavioral2/memory/3248-57-0x0000000005E70000-0x0000000006EFE000-memory.dmp upx behavioral2/memory/3248-62-0x0000000005E70000-0x0000000006EFE000-memory.dmp upx behavioral2/memory/3248-56-0x0000000005E70000-0x0000000006EFE000-memory.dmp upx behavioral2/memory/3248-63-0x0000000005E70000-0x0000000006EFE000-memory.dmp upx behavioral2/memory/3248-64-0x0000000005E70000-0x0000000006EFE000-memory.dmp upx behavioral2/memory/3248-65-0x0000000005E70000-0x0000000006EFE000-memory.dmp upx behavioral2/memory/3248-69-0x0000000005E70000-0x0000000006EFE000-memory.dmp upx behavioral2/memory/3248-70-0x0000000005E70000-0x0000000006EFE000-memory.dmp upx behavioral2/memory/3248-88-0x0000000005E70000-0x0000000006EFE000-memory.dmp upx behavioral2/memory/3248-89-0x0000000005E70000-0x0000000006EFE000-memory.dmp upx behavioral2/memory/3248-92-0x0000000005E70000-0x0000000006EFE000-memory.dmp upx behavioral2/memory/3248-93-0x0000000005E70000-0x0000000006EFE000-memory.dmp upx behavioral2/memory/3248-94-0x0000000005E70000-0x0000000006EFE000-memory.dmp upx behavioral2/memory/3248-104-0x0000000005E70000-0x0000000006EFE000-memory.dmp upx behavioral2/memory/3248-107-0x0000000005E70000-0x0000000006EFE000-memory.dmp upx behavioral2/memory/3248-109-0x0000000005E70000-0x0000000006EFE000-memory.dmp upx behavioral2/memory/3248-112-0x0000000005E70000-0x0000000006EFE000-memory.dmp upx behavioral2/memory/3248-113-0x0000000005E70000-0x0000000006EFE000-memory.dmp upx behavioral2/memory/3248-123-0x0000000005E70000-0x0000000006EFE000-memory.dmp upx -
Processes:
ireA.exe2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ireA.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe -
Processes:
2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exeireA.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ireA.exe -
Enumerates connected drives 3 TTPs 8 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
ireA.exedescription ioc process File opened (read-only) \??\K: ireA.exe File opened (read-only) \??\L: ireA.exe File opened (read-only) \??\M: ireA.exe File opened (read-only) \??\E: ireA.exe File opened (read-only) \??\G: ireA.exe File opened (read-only) \??\H: ireA.exe File opened (read-only) \??\I: ireA.exe File opened (read-only) \??\J: ireA.exe -
Drops file in Program Files directory 64 IoCs
Processes:
ireA.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7zG.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE ireA.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe ireA.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe ireA.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe ireA.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE ireA.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe ireA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe ireA.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe ireA.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe ireA.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe ireA.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe ireA.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe ireA.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe ireA.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe ireA.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe ireA.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe ireA.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe ireA.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe ireA.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE ireA.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe ireA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe ireA.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe ireA.exe -
Drops file in Windows directory 1 IoCs
Processes:
2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exeireA.exepid process 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe 3248 ireA.exe 3248 ireA.exe 3248 ireA.exe 3248 ireA.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exedescription pid process Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Token: SeDebugPrivilege 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exepid process 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe -
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exeireA.exedescription pid process target process PID 3144 wrote to memory of 3248 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe ireA.exe PID 3144 wrote to memory of 3248 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe ireA.exe PID 3144 wrote to memory of 3248 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe ireA.exe PID 3144 wrote to memory of 792 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe fontdrvhost.exe PID 3144 wrote to memory of 800 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe fontdrvhost.exe PID 3144 wrote to memory of 380 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe dwm.exe PID 3144 wrote to memory of 2720 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe sihost.exe PID 3144 wrote to memory of 2728 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe svchost.exe PID 3144 wrote to memory of 2960 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe taskhostw.exe PID 3144 wrote to memory of 3520 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Explorer.EXE PID 3144 wrote to memory of 3644 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe svchost.exe PID 3144 wrote to memory of 3840 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe DllHost.exe PID 3144 wrote to memory of 4012 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe StartMenuExperienceHost.exe PID 3144 wrote to memory of 4072 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe RuntimeBroker.exe PID 3144 wrote to memory of 3872 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe SearchApp.exe PID 3144 wrote to memory of 4124 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe RuntimeBroker.exe PID 3144 wrote to memory of 392 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe RuntimeBroker.exe PID 3144 wrote to memory of 2292 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe TextInputHost.exe PID 3144 wrote to memory of 4556 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe backgroundTaskHost.exe PID 3144 wrote to memory of 4888 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe backgroundTaskHost.exe PID 3144 wrote to memory of 3248 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe ireA.exe PID 3144 wrote to memory of 3248 3144 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe ireA.exe PID 3248 wrote to memory of 792 3248 ireA.exe fontdrvhost.exe PID 3248 wrote to memory of 800 3248 ireA.exe fontdrvhost.exe PID 3248 wrote to memory of 380 3248 ireA.exe dwm.exe PID 3248 wrote to memory of 2720 3248 ireA.exe sihost.exe PID 3248 wrote to memory of 2728 3248 ireA.exe svchost.exe PID 3248 wrote to memory of 2960 3248 ireA.exe taskhostw.exe PID 3248 wrote to memory of 3520 3248 ireA.exe Explorer.EXE PID 3248 wrote to memory of 3644 3248 ireA.exe svchost.exe PID 3248 wrote to memory of 3840 3248 ireA.exe DllHost.exe PID 3248 wrote to memory of 4012 3248 ireA.exe StartMenuExperienceHost.exe PID 3248 wrote to memory of 4072 3248 ireA.exe RuntimeBroker.exe PID 3248 wrote to memory of 3872 3248 ireA.exe SearchApp.exe PID 3248 wrote to memory of 4124 3248 ireA.exe RuntimeBroker.exe PID 3248 wrote to memory of 392 3248 ireA.exe RuntimeBroker.exe PID 3248 wrote to memory of 2292 3248 ireA.exe TextInputHost.exe PID 3248 wrote to memory of 4556 3248 ireA.exe backgroundTaskHost.exe PID 3248 wrote to memory of 4888 3248 ireA.exe backgroundTaskHost.exe PID 3248 wrote to memory of 1844 3248 ireA.exe RuntimeBroker.exe PID 3248 wrote to memory of 3096 3248 ireA.exe RuntimeBroker.exe PID 3248 wrote to memory of 1216 3248 ireA.exe BackgroundTransferHost.exe PID 3248 wrote to memory of 792 3248 ireA.exe fontdrvhost.exe PID 3248 wrote to memory of 800 3248 ireA.exe fontdrvhost.exe PID 3248 wrote to memory of 380 3248 ireA.exe dwm.exe PID 3248 wrote to memory of 2720 3248 ireA.exe sihost.exe PID 3248 wrote to memory of 2728 3248 ireA.exe svchost.exe PID 3248 wrote to memory of 2960 3248 ireA.exe taskhostw.exe PID 3248 wrote to memory of 3520 3248 ireA.exe Explorer.EXE PID 3248 wrote to memory of 3644 3248 ireA.exe svchost.exe PID 3248 wrote to memory of 3840 3248 ireA.exe DllHost.exe PID 3248 wrote to memory of 4012 3248 ireA.exe StartMenuExperienceHost.exe PID 3248 wrote to memory of 4072 3248 ireA.exe RuntimeBroker.exe PID 3248 wrote to memory of 3872 3248 ireA.exe SearchApp.exe PID 3248 wrote to memory of 4124 3248 ireA.exe RuntimeBroker.exe PID 3248 wrote to memory of 392 3248 ireA.exe RuntimeBroker.exe PID 3248 wrote to memory of 2292 3248 ireA.exe TextInputHost.exe PID 3248 wrote to memory of 4556 3248 ireA.exe backgroundTaskHost.exe PID 3248 wrote to memory of 4888 3248 ireA.exe backgroundTaskHost.exe PID 3248 wrote to memory of 1844 3248 ireA.exe RuntimeBroker.exe PID 3248 wrote to memory of 3096 3248 ireA.exe RuntimeBroker.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exeireA.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ireA.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_22c3b92d4a7b00c09b9a01dc41c5484f_icedid_wapomi.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\ireA.exeC:\Users\Admin\AppData\Local\Temp\ireA.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2b305253.bat" "4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2IX84YPE\k2[1].rarFilesize
4B
MD5d3b07384d113edec49eaa6238ad5ff00
SHA1f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA5120cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6
-
C:\Users\Admin\AppData\Local\Temp\1E2D7586.exeFilesize
4B
MD520879c987e2f9a916e578386d499f629
SHA1c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA2569f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
-
C:\Users\Admin\AppData\Local\Temp\2b305253.batFilesize
183B
MD50c2eaab69339b1949469c93984d45b2e
SHA1b0350805aef921c17577a6ef775c530af1cfee4e
SHA256ad6db9082bfc007b50dc1f3b96a8119c61129799b8ccbed4d01073848aa006f6
SHA5125f246cc2849cb112ab44ffe26bf89a091f727c566060c1160a3a1b42a8604fabceed2113018633617753cfec93e4571e44411c5934f9dc60dae84d211cac8b88
-
C:\Users\Admin\AppData\Local\Temp\ireA.exeFilesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
C:\Windows\SYSTEM.INIFilesize
257B
MD532697b5ff82ab76f5af24d469185b0e7
SHA1acc10d3ee5da494d28da4b4931b9641facc722ab
SHA256c90b72cb2c0e377574a4def065b61196f1c4dedfb88d6a655b69e9f9da11efc6
SHA512b644c74f3779aece7abb191912d4b0e4413e93c0d375a7825767b6cb2fb7602416d558d303dcbbecec36debdab9ff560a005e3ae952ac73a295978a2bf6a1b61
-
memory/3144-32-0x00000000024B0000-0x000000000353E000-memory.dmpFilesize
16.6MB
-
memory/3144-17-0x0000000000800000-0x0000000000802000-memory.dmpFilesize
8KB
-
memory/3144-23-0x00000000024B0000-0x000000000353E000-memory.dmpFilesize
16.6MB
-
memory/3144-20-0x0000000000800000-0x0000000000802000-memory.dmpFilesize
8KB
-
memory/3144-19-0x00000000024B0000-0x000000000353E000-memory.dmpFilesize
16.6MB
-
memory/3144-9-0x00000000024B0000-0x000000000353E000-memory.dmpFilesize
16.6MB
-
memory/3144-24-0x00000000024B0000-0x000000000353E000-memory.dmpFilesize
16.6MB
-
memory/3144-28-0x0000000000800000-0x0000000000802000-memory.dmpFilesize
8KB
-
memory/3144-37-0x0000000000400000-0x00000000005CB000-memory.dmpFilesize
1.8MB
-
memory/3144-16-0x00000000024B0000-0x000000000353E000-memory.dmpFilesize
16.6MB
-
memory/3144-0-0x0000000000400000-0x00000000005CB000-memory.dmpFilesize
1.8MB
-
memory/3144-7-0x00000000024B0000-0x000000000353E000-memory.dmpFilesize
16.6MB
-
memory/3144-4-0x00000000024B0000-0x000000000353E000-memory.dmpFilesize
16.6MB
-
memory/3144-8-0x00000000024B0000-0x000000000353E000-memory.dmpFilesize
16.6MB
-
memory/3144-13-0x0000000004100000-0x0000000004101000-memory.dmpFilesize
4KB
-
memory/3144-12-0x0000000000800000-0x0000000000802000-memory.dmpFilesize
8KB
-
memory/3144-3-0x00000000024B0000-0x000000000353E000-memory.dmpFilesize
16.6MB
-
memory/3144-1-0x00000000024B0000-0x000000000353E000-memory.dmpFilesize
16.6MB
-
memory/3248-51-0x0000000000250000-0x0000000000259000-memory.dmpFilesize
36KB
-
memory/3248-65-0x0000000005E70000-0x0000000006EFE000-memory.dmpFilesize
16.6MB
-
memory/3248-18-0x0000000001140000-0x0000000001142000-memory.dmpFilesize
8KB
-
memory/3248-21-0x0000000001140000-0x0000000001142000-memory.dmpFilesize
8KB
-
memory/3248-60-0x0000000005E70000-0x0000000006EFE000-memory.dmpFilesize
16.6MB
-
memory/3248-59-0x0000000005E70000-0x0000000006EFE000-memory.dmpFilesize
16.6MB
-
memory/3248-54-0x0000000005E70000-0x0000000006EFE000-memory.dmpFilesize
16.6MB
-
memory/3248-55-0x0000000005E70000-0x0000000006EFE000-memory.dmpFilesize
16.6MB
-
memory/3248-61-0x0000000005E70000-0x0000000006EFE000-memory.dmpFilesize
16.6MB
-
memory/3248-58-0x0000000005E70000-0x0000000006EFE000-memory.dmpFilesize
16.6MB
-
memory/3248-57-0x0000000005E70000-0x0000000006EFE000-memory.dmpFilesize
16.6MB
-
memory/3248-62-0x0000000005E70000-0x0000000006EFE000-memory.dmpFilesize
16.6MB
-
memory/3248-56-0x0000000005E70000-0x0000000006EFE000-memory.dmpFilesize
16.6MB
-
memory/3248-63-0x0000000005E70000-0x0000000006EFE000-memory.dmpFilesize
16.6MB
-
memory/3248-64-0x0000000005E70000-0x0000000006EFE000-memory.dmpFilesize
16.6MB
-
memory/3248-15-0x0000000001190000-0x0000000001191000-memory.dmpFilesize
4KB
-
memory/3248-69-0x0000000005E70000-0x0000000006EFE000-memory.dmpFilesize
16.6MB
-
memory/3248-70-0x0000000005E70000-0x0000000006EFE000-memory.dmpFilesize
16.6MB
-
memory/3248-88-0x0000000005E70000-0x0000000006EFE000-memory.dmpFilesize
16.6MB
-
memory/3248-89-0x0000000005E70000-0x0000000006EFE000-memory.dmpFilesize
16.6MB
-
memory/3248-92-0x0000000005E70000-0x0000000006EFE000-memory.dmpFilesize
16.6MB
-
memory/3248-93-0x0000000005E70000-0x0000000006EFE000-memory.dmpFilesize
16.6MB
-
memory/3248-94-0x0000000005E70000-0x0000000006EFE000-memory.dmpFilesize
16.6MB
-
memory/3248-104-0x0000000005E70000-0x0000000006EFE000-memory.dmpFilesize
16.6MB
-
memory/3248-107-0x0000000005E70000-0x0000000006EFE000-memory.dmpFilesize
16.6MB
-
memory/3248-109-0x0000000005E70000-0x0000000006EFE000-memory.dmpFilesize
16.6MB
-
memory/3248-112-0x0000000005E70000-0x0000000006EFE000-memory.dmpFilesize
16.6MB
-
memory/3248-113-0x0000000005E70000-0x0000000006EFE000-memory.dmpFilesize
16.6MB
-
memory/3248-123-0x0000000005E70000-0x0000000006EFE000-memory.dmpFilesize
16.6MB
-
memory/3248-22-0x0000000000250000-0x0000000000259000-memory.dmpFilesize
36KB