Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28-05-2024 18:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe
-
Size
10.0MB
-
MD5
e3f20b44500294ef2590e1641aef580a
-
SHA1
e4a3be03f4b233db7f4c26c6688832d006f17df8
-
SHA256
98fa92e6fee2cebb86d96fb00f28864bb8ad2373f188ac3776d3802ba9c747be
-
SHA512
c2b6d897f20221d554eb77e335983443ed59d3af7706c8c914c9adc0d9647fa286e5efdefbae17019281653d8ce5f1ff3bbc6f1e98644bc70c258da4df710268
-
SSDEEP
98304:3u5x6M1WopNhS9Yw8yPNhS9Yw8yuFhHZhANhS9Yw8yEF:AiewflwfAh+wfEF
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\windows\SysWOW64\drivers\spo0lve.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\windows\SysWOW64\drivers\spo0lve.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe" 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File created C:\Program Files\Windows Defender\MSASCui.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File created C:\Program Files\Windows Mail\WinMail.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File created C:\Program Files\Windows Mail\wab.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe 2044 2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-28_e3f20b44500294ef2590e1641aef580a_icedid.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2044
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.0MB
MD5a5aa2c5ae415eabe0e7b721aeed7f322
SHA139ab39011ad6f4e8940665ad5d836a4175e6c48e
SHA256f943a1ce4842d52f11e2d33b34f4931049c379059437860cb50640a258fd69d9
SHA5129e44b44937ae936956bb41d27a5608d4e99dfe784122cfc45d85b5cdedf6e003ee243bdda0f76b863e211bfdc7081aa637dcb3c393aa2f8b6ce81646e9d3ab1b