Analysis
- max time kernel
26s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
28/05/2024, 21:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe
Resource
win7-20240508-en
windows7-x64
16 signatures
150 seconds
General
- Target 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe
- Size 11.5MB
- Sample240528-1dc4fsed28
- SHA256 eca844e81be6c7c82a329dfb4d31bc61a7d6b82e64758cb1cdbf15450910d686
- MD5 6a2839b47bde6cb093f618cfd6fe63a4
- SHA1 f892a7537f9cb00cb1c5b1aefe8652b59aed818c
- SHA512 010a5e7b4bf8a649529745d1fd0ccb4712c7c6047e6bc916a5b4145f8fcb44ed98dce34e9e47b02a9d1da84c02db42a38bc5df2c8f713650775874e8ee523812
- SSDEEP 98304:rSy3mKysr9uBx4WZTvyqL+R6ZiFLOAkGkzdnEVomFHKnPLc96hxvWbrtUTrUHO23:rjB2AqL+RPFLOyomFHKnPLcAx+NcIOA
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" explorer.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" explorer.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" explorer.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 39 IoCs
resource yara_rule behavioral2/memory/2984-0-0x0000000002B40000-0x0000000003BCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2984-2-0x0000000002B40000-0x0000000003BCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2984-12-0x0000000002B40000-0x0000000003BCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2984-5-0x0000000002B40000-0x0000000003BCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2984-15-0x0000000002B40000-0x0000000003BCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2984-14-0x0000000002B40000-0x0000000003BCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2984-16-0x0000000002B40000-0x0000000003BCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2984-3-0x0000000002B40000-0x0000000003BCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2984-4-0x0000000002B40000-0x0000000003BCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2984-20-0x0000000002B40000-0x0000000003BCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-32-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-34-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-35-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-36-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-37-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-38-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-39-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-40-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-41-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-42-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-43-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-44-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-45-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-46-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-48-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-49-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-50-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-52-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-53-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-55-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-57-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-60-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-62-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-64-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-66-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-68-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-70-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4852-95-0x0000000002DD0000-0x0000000003E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/files/0x000100000000002b-104.dat INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 40 IoCs
resource yara_rule behavioral2/memory/2984-0-0x0000000002B40000-0x0000000003BCE000-memory.dmp UPX behavioral2/memory/2984-2-0x0000000002B40000-0x0000000003BCE000-memory.dmp UPX behavioral2/memory/2984-12-0x0000000002B40000-0x0000000003BCE000-memory.dmp UPX behavioral2/memory/2984-5-0x0000000002B40000-0x0000000003BCE000-memory.dmp UPX behavioral2/memory/2984-15-0x0000000002B40000-0x0000000003BCE000-memory.dmp UPX behavioral2/memory/2984-14-0x0000000002B40000-0x0000000003BCE000-memory.dmp UPX behavioral2/memory/2984-16-0x0000000002B40000-0x0000000003BCE000-memory.dmp UPX behavioral2/memory/2984-3-0x0000000002B40000-0x0000000003BCE000-memory.dmp UPX behavioral2/memory/2984-7-0x0000000000400000-0x0000000000DB0000-memory.dmp UPX behavioral2/memory/2984-4-0x0000000002B40000-0x0000000003BCE000-memory.dmp UPX behavioral2/memory/2984-20-0x0000000002B40000-0x0000000003BCE000-memory.dmp UPX behavioral2/memory/2984-31-0x0000000000400000-0x0000000000DB0000-memory.dmp UPX behavioral2/memory/4852-32-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-34-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-35-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-36-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-37-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-38-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-39-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-40-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-41-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-42-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-43-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-44-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-45-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-46-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-48-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-49-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-50-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-52-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-53-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-55-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-57-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-60-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-62-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-64-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-66-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-68-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-70-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX behavioral2/memory/4852-95-0x0000000002DD0000-0x0000000003E5E000-memory.dmp UPX - Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" explorer.exe - Disables Task Manager via registry modification
- Deletes itself 1 IoCs
pid Process 4852 explorer.exe -
resource yara_rule behavioral2/memory/2984-0-0x0000000002B40000-0x0000000003BCE000-memory.dmp upx behavioral2/memory/2984-2-0x0000000002B40000-0x0000000003BCE000-memory.dmp upx behavioral2/memory/2984-12-0x0000000002B40000-0x0000000003BCE000-memory.dmp upx behavioral2/memory/2984-5-0x0000000002B40000-0x0000000003BCE000-memory.dmp upx behavioral2/memory/2984-15-0x0000000002B40000-0x0000000003BCE000-memory.dmp upx behavioral2/memory/2984-14-0x0000000002B40000-0x0000000003BCE000-memory.dmp upx behavioral2/memory/2984-16-0x0000000002B40000-0x0000000003BCE000-memory.dmp upx behavioral2/memory/2984-3-0x0000000002B40000-0x0000000003BCE000-memory.dmp upx behavioral2/memory/2984-4-0x0000000002B40000-0x0000000003BCE000-memory.dmp upx behavioral2/memory/2984-20-0x0000000002B40000-0x0000000003BCE000-memory.dmp upx behavioral2/memory/4852-32-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-34-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-35-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-36-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-37-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-38-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-39-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-40-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-41-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-42-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-43-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-44-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-45-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-46-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-48-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-49-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-50-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-52-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-53-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-55-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-57-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-60-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-62-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-64-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-66-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-68-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-70-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx behavioral2/memory/4852-95-0x0000000002DD0000-0x0000000003E5E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe - Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\G: explorer.exe File opened (read-only) \??\H: explorer.exe File opened (read-only) \??\I: explorer.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe - Program crash 1 IoCs
pid pid_target Process procid_target 4624 2984 WerFault.exe 81 - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe Token: SeDebugPrivilege 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe - Suspicious use of WriteProcessMemory 58 IoCs
description pid Process procid_target PID 2984 wrote to memory of 4852 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe 82 PID 2984 wrote to memory of 4852 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe 82 PID 2984 wrote to memory of 4852 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe 82 PID 2984 wrote to memory of 760 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe 8 PID 2984 wrote to memory of 764 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe 9 PID 2984 wrote to memory of 1016 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe 13 PID 2984 wrote to memory of 2480 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe 42 PID 2984 wrote to memory of 2500 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe 43 PID 2984 wrote to memory of 2684 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe 46 PID 2984 wrote to memory of 3500 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe 56 PID 2984 wrote to memory of 3648 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe 57 PID 2984 wrote to memory of 3824 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe 58 PID 2984 wrote to memory of 3912 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe 59 PID 2984 wrote to memory of 3972 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe 60 PID 2984 wrote to memory of 4060 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe 61 PID 2984 wrote to memory of 3944 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe 62 PID 2984 wrote to memory of 456 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe 73 PID 2984 wrote to memory of 2572 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe 74 PID 2984 wrote to memory of 2812 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe 79 PID 2984 wrote to memory of 440 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe 80 PID 2984 wrote to memory of 4852 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe 82 PID 2984 wrote to memory of 4852 2984 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe 82 PID 4852 wrote to memory of 760 4852 explorer.exe 8 PID 4852 wrote to memory of 764 4852 explorer.exe 9 PID 4852 wrote to memory of 1016 4852 explorer.exe 13 PID 4852 wrote to memory of 2480 4852 explorer.exe 42 PID 4852 wrote to memory of 2500 4852 explorer.exe 43 PID 4852 wrote to memory of 2684 4852 explorer.exe 46 PID 4852 wrote to memory of 3500 4852 explorer.exe 56 PID 4852 wrote to memory of 3648 4852 explorer.exe 57 PID 4852 wrote to memory of 3824 4852 explorer.exe 58 PID 4852 wrote to memory of 3912 4852 explorer.exe 59 PID 4852 wrote to memory of 3972 4852 explorer.exe 60 PID 4852 wrote to memory of 4060 4852 explorer.exe 61 PID 4852 wrote to memory of 3944 4852 explorer.exe 62 PID 4852 wrote to memory of 456 4852 explorer.exe 73 PID 4852 wrote to memory of 2572 4852 explorer.exe 74 PID 4852 wrote to memory of 2812 4852 explorer.exe 79 PID 4852 wrote to memory of 2064 4852 explorer.exe 87 PID 4852 wrote to memory of 5096 4852 explorer.exe 88 PID 4852 wrote to memory of 760 4852 explorer.exe 8 PID 4852 wrote to memory of 764 4852 explorer.exe 9 PID 4852 wrote to memory of 1016 4852 explorer.exe 13 PID 4852 wrote to memory of 2480 4852 explorer.exe 42 PID 4852 wrote to memory of 2500 4852 explorer.exe 43 PID 4852 wrote to memory of 2684 4852 explorer.exe 46 PID 4852 wrote to memory of 3500 4852 explorer.exe 56 PID 4852 wrote to memory of 3648 4852 explorer.exe 57 PID 4852 wrote to memory of 3824 4852 explorer.exe 58 PID 4852 wrote to memory of 3912 4852 explorer.exe 59 PID 4852 wrote to memory of 3972 4852 explorer.exe 60 PID 4852 wrote to memory of 4060 4852 explorer.exe 61 PID 4852 wrote to memory of 3944 4852 explorer.exe 62 PID 4852 wrote to memory of 456 4852 explorer.exe 73 PID 4852 wrote to memory of 2572 4852 explorer.exe 74 PID 4852 wrote to memory of 2812 4852 explorer.exe 79 PID 4852 wrote to memory of 2064 4852 explorer.exe 87 PID 4852 wrote to memory of 5096 4852 explorer.exe 88 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:760
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:764
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1016
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2500
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2684
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2984 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Deletes itself
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4852
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 8363⤵
- Program crash
PID:4624
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3648
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3824
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3912
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3972
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4060
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3944
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:456
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2572
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:2812
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2984 -ip 29841⤵PID:792
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2064
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:5096
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 20bdc3adba2756f89501d714a1f71e723f9856262fa8daf55f1a80284e428f0b
- MD5 bd2db8131d1807e69481d25f03424ec5
- SHA1 6d72c52c0d0d477c2630f2db32436af9b81713d0
- SHA512 6749df393ccbc4e30dd147b9c3c89933e1ec350fc185523648d4c809274b500cbdced197873b054ff01001e821209d8c6fbd30e19d286fdeb1cf16ebe2df5d3b
- MD5 SHA1 SHA512
- Path F:\ucql.pif
- Size 100KB
- SHA256 d0a2e4889f0330ae74cdc5505cd5da50efc319e1ae37d3fc97fbc1a600e9d740
- MD5 7b92ce7d1d3bd0aa3ed1b23d0868475e
- SHA1 31bf1063d1eaae164ac72f51886bcf178d984049
- SHA512 4b6a4f8989b3d79d8cbe6c240de733d59793e5a53397bd6b3884fd26364af19b1c4a6ef4279869b0292a30b2a6f1a73efcf5573c63894b66a50afd33a1cc3a9a
- SSDEEP 3072:vFi8RNZ7j5GjVdAu5i+g6Zu6HGqhrm5m:dBTt5GHAu59g+HJrm4
- MD5 SHA1 SHA512 SSDEEP