Analysis
-
max time kernel
147s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
27-05-2024 23:25
General
-
Target
2024-05-27_55583b5d1cf5bf17a8a444d703105a51_icedid_nymaim.exe
-
Size
4.4MB
-
MD5
55583b5d1cf5bf17a8a444d703105a51
-
SHA1
4505a809d5a47b3d13fc687c202734922f227f4b
-
SHA256
7b58053dd98be526f54646ff764e3a08e83ae5fae1975ddd5ad2f9f4197bdd49
-
SHA512
f87c625903653c14a26d2c4959bcad0a08974ff46c562a99749031ab585238bc759072ce5b2bd1e0d60ce2e524cc84a4e64c41fd09870c5062037b8cbb5f2daa
-
SSDEEP
49152:LFic9QERhCbKh4w8OZLniJdfdPxTROPE41oS5HiAGuj7Ql:Lv9QUHhmarwdPBRi1T5HiAGse
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 31 IoCs
-
UPX dump on OEP (original entry point) 30 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Disables Task Manager via registry modification
-
UPX packed file 30 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 5 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
-
Suspicious use of AdjustPrivilegeToken 32 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 53 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_55583b5d1cf5bf17a8a444d703105a51_icedid_nymaim.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_55583b5d1cf5bf17a8a444d703105a51_icedid_nymaim.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\PWRISOSH.DLL"3⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\$PowerISO$\1C66.tmp.icoFilesize
2KB
MD54198afdeb9ace242c575ee572af22e1f
SHA132784594ec69ca459878010401c3931be8e5e15e
SHA256b4d6704aabfcc8b7cb8f4ee58b162dd124e2d0e4dce20ecf13eebd262dd1e76e
SHA512d4288466d9a669c7735dc788f81fd5581876048644c48a58df5e2f8c70d468464d9de2bcbd295cdfe8510fd77a9a3cc26e3de0a1cf985622fec00baefda7f4cc
-
F:\ndcrhg.exeFilesize
100KB
MD5291683054f1eb4e725ae8dafe0cba8ce
SHA16576e5b16d6a88f05bab26cd3a9bc6ffbffe56f9
SHA256005118bbacc57ed7c4d379d620be22bf0b63ca4767a52365c319565afb414987
SHA512c0fdbf97f9f01e3cda251fc45c5312b23efb9aa0c968614f6b7b8dd70c11d0157b481c6061541b868e3b85361af42b15e95302f76e1531234df2bd560a8df90d
-
memory/1072-12-0x00000000002A0000-0x00000000002A2000-memory.dmpFilesize
8KB
-
memory/3020-34-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-81-0x00000000003D0000-0x00000000003D2000-memory.dmpFilesize
8KB
-
memory/3020-6-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-35-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-22-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/3020-20-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/3020-19-0x00000000003D0000-0x00000000003D2000-memory.dmpFilesize
8KB
-
memory/3020-5-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-1-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-11-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-9-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-24-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-26-0x00000000003D0000-0x00000000003D2000-memory.dmpFilesize
8KB
-
memory/3020-25-0x00000000003D0000-0x00000000003D2000-memory.dmpFilesize
8KB
-
memory/3020-10-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-23-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-3-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-0-0x0000000000400000-0x00000000009CB000-memory.dmpFilesize
5.8MB
-
memory/3020-4-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-7-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-45-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-38-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-46-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-48-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-50-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-52-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-54-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-55-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-58-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-61-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-63-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-75-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-76-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-78-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-79-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-36-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB
-
memory/3020-8-0x00000000024E0000-0x000000000356E000-memory.dmpFilesize
16.6MB