c:\srt\titanftp\srxAdmin\Win32\SR Release\srxAdmin.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-03_13b9f8d1dab0f47a51d015c62753daae_icedid.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-03_13b9f8d1dab0f47a51d015c62753daae_icedid.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-03_13b9f8d1dab0f47a51d015c62753daae_icedid
-
Size
7.1MB
-
MD5
13b9f8d1dab0f47a51d015c62753daae
-
SHA1
9f881f37626965784a3f6331daf7f8182122bc25
-
SHA256
d93965934936df7cbad4ad02da38e21958fe30978a28d526aadd9b23e6a4a40b
-
SHA512
a90380bf89c1aba4a3883c46a44403d433020f1e395a440dd8fb37831bf4aefc6d445bdeeee76ab950f218b8c597bf9c7790d8dba27a5c09bfe2a845926e89e6
-
SSDEEP
98304:wuHQEcHd4O3IH5xNVLRwGmNtUKgOQEmuxSR7akpwtPQkd/C6+46dejnq:FQEcHrYH5xXmg0QXu0B6L7+40ejnq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-03_13b9f8d1dab0f47a51d015c62753daae_icedid
Files
-
2024-06-03_13b9f8d1dab0f47a51d015c62753daae_icedid.exe windows:4 windows x86 arch:x86
64db22fa642c0f07bc448ab11771ab45
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
netapi32
NetApiBufferFree
Netbios
NetUserModalsGet
NetServerEnum
NetWkstaGetInfo
NetQueryDisplayInformation
NetLocalGroupEnum
NetGroupGetUsers
NetLocalGroupGetMembers
NetUserGetGroups
NetUserGetLocalGroups
NetUserGetInfo
NetGroupGetInfo
NetLocalGroupGetInfo
NetShareEnum
kernel32
GlobalLock
EnumResourceLanguagesA
ConvertDefaultLocale
GlobalDeleteAtom
SetThreadPriority
SuspendThread
GlobalAddAtomA
lstrcmpW
GlobalFindAtomA
GlobalGetAtomNameA
FreeResource
VirtualProtect
GlobalFree
GlobalUnlock
MulDiv
GlobalSize
GetDiskFreeSpaceA
GetPrivateProfileIntA
WritePrivateProfileStringA
GetPrivateProfileStringA
CreateMutexA
ReleaseMutex
GlobalReAlloc
MoveFileA
GetThreadLocale
FlushFileBuffers
DuplicateHandle
lstrcpyW
GlobalFlags
TlsGetValue
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GetOEMCP
GetAtomNameA
FindResourceExA
SetErrorMode
RtlUnwind
GlobalAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
GetTimeFormatA
GetDateFormatA
GetCommandLineA
GetStartupInfoA
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetConsoleCtrlHandler
PeekNamedPipe
ExitProcess
HeapSize
SetStdHandle
FatalAppExitA
VirtualFree
HeapDestroy
HeapCreate
IsValidCodePage
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetConsoleCP
GetConsoleMode
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
SetEnvironmentVariableA
GetExitCodeProcess
DeviceIoControl
OpenProcess
LocalFileTimeToFileTime
FileTimeToLocalFileTime
FlushInstructionCache
GetCurrentProcess
GetProcessHeap
HeapAlloc
HeapFree
InterlockedExchangeAdd
GetOverlappedResult
FlushConsoleInputBuffer
GetModuleFileNameW
GetFullPathNameW
GetFullPathNameA
CancelIo
CreateEventA
CreateThread
QueryPerformanceFrequency
GetThreadTimes
GlobalMemoryStatus
QueryPerformanceCounter
GetLocaleInfoA
EnumCalendarInfoA
GetSystemTimeAsFileTime
GetLocalTime
SystemTimeToFileTime
FileTimeToSystemTime
CopyFileA
GetFileInformationByHandle
SetFileTime
GetFileTime
GetCurrentProcessId
ExitThread
GetCPInfo
GetStdHandle
GetFileType
GetSystemDirectoryA
CreateProcessA
GetACP
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
LocalUnlock
LocalLock
InterlockedCompareExchange
TerminateThread
PulseEvent
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
OpenEventA
ReadConsoleInputA
SetConsoleMode
UnmapViewOfFile
ReleaseSemaphore
CreateSemaphoreA
lstrcmpA
GetTickCount
GetFileSizeEx
SetCurrentDirectoryW
SetCurrentDirectoryA
GetCurrentDirectoryW
GetCurrentDirectoryA
GetDriveTypeW
CreateDirectoryW
MoveFileExW
MoveFileExA
RemoveDirectoryW
RemoveDirectoryA
UnlockFile
LockFile
GetTempFileNameW
GetFileAttributesExW
GetFileAttributesExA
GetFileAttributesW
GetDiskFreeSpaceExW
GetDiskFreeSpaceExA
SetFileAttributesW
FindNextFileW
FindFirstFileW
SetEndOfFile
GetCurrentThread
CreateFileW
LeaveCriticalSection
TryEnterCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
lstrcpynA
SystemTimeToTzSpecificLocalTime
FindNextFileA
CreateDirectoryA
GetShortPathNameA
FindFirstFileA
GetFileSize
SleepEx
WriteFile
CreateFileA
ReadFile
SetFilePointer
CloseHandle
SetFileAttributesA
WaitForSingleObject
GetSystemTime
GetComputerNameA
FindClose
GetTempFileNameA
LocalAlloc
GetModuleFileNameA
lstrcatA
lstrcpyA
GetCurrentThreadId
OutputDebugStringA
WinExec
FormatMessageA
LocalFree
GetTimeZoneInformation
Sleep
DeleteFileA
ResetEvent
SetEvent
PeekConsoleInputA
GetNumberOfConsoleInputEvents
ResumeThread
WaitForSingleObjectEx
GetLogicalDrives
GetVolumeInformationA
FindFirstChangeNotificationA
WaitForMultipleObjects
FindNextChangeNotification
FindCloseChangeNotification
GetFileAttributesA
GetDriveTypeA
FreeLibrary
GetVersionExA
GetTempPathA
GetWindowsDirectoryA
lstrlenA
lstrcmpiA
lstrcmpiW
GetStringTypeExA
GetStringTypeExW
lstrlenW
CompareStringA
CompareStringW
GetEnvironmentVariableA
MultiByteToWideChar
InterlockedExchange
GetVersion
GetEnvironmentVariableW
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
LoadResource
LockResource
SizeofResource
FindResourceA
GetModuleHandleA
LoadLibraryA
GetProcAddress
GetLastError
SetLastError
VirtualAlloc
user32
IsIconic
GetWindowPlacement
GetWindowTextLengthA
SetWindowPos
IsChild
WinHelpA
LoadIconA
GetAsyncKeyState
ScrollWindowEx
SetFocus
ShowWindow
MoveWindow
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
GetWindowThreadProcessId
GetLastActivePopup
IsWindowEnabled
ShowOwnedPopups
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
PostQuitMessage
MsgWaitForMultipleObjectsEx
GetClassInfoA
RegisterClassA
CreateWindowExA
DestroyWindow
DefWindowProcA
SetWindowPlacement
PeekMessageA
GetScrollInfo
SendMessageW
GetCaretPos
GetWindowTextA
MapDialogRect
RemovePropA
FindWindowA
SetForegroundWindow
IntersectRect
GetMessageA
DrawFrameControl
GetProcessWindowStation
GetUserObjectInformationW
LoadBitmapA
GetActiveWindow
SystemParametersInfoA
WindowFromPoint
CallWindowProcA
DrawTextA
FillRect
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowLongA
DestroyIcon
DrawFocusRect
OffsetRect
SetRectEmpty
IsRectEmpty
CopyRect
GetMessagePos
GetDlgCtrlID
GetDlgItem
GetWindowLongA
SetRect
SetScrollInfo
DeferWindowPos
EqualRect
AdjustWindowRectEx
GetClassInfoExA
ShowScrollBar
GetScrollPos
SetScrollPos
GetScrollRange
SetScrollRange
TrackPopupMenu
TrackPopupMenuEx
ScrollWindow
GetFocus
RegisterWindowMessageA
MapWindowPoints
GetMessageTime
EndDeferWindowPos
BeginDeferWindowPos
SetActiveWindow
GetTopWindow
GetForegroundWindow
wsprintfA
LoadStringA
IsMenu
ReleaseDC
GetDC
InflateRect
MessageBeep
CopyIcon
MessageBoxA
SetWindowTextA
InsertMenuA
GetMenuStringA
CreatePopupMenu
GetWindow
InvalidateRect
GetPropA
SetPropA
EnumChildWindows
GetClassLongA
GetSystemMetrics
LoadCursorA
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamA
RemoveMenu
AppendMenuA
TranslateAcceleratorA
SetMenu
BringWindowToTop
InsertMenuItemA
LoadAcceleratorsA
DestroyMenu
ReuseDDElParam
UnpackDDElParam
SetCursorPos
DestroyCursor
GetKeyNameTextA
MapVirtualKeyA
TabbedTextOutA
DrawTextExA
GrayStringA
GetWindowDC
BeginPaint
EndPaint
IsZoomed
DeleteMenu
GetSystemMenu
SetParent
MsgWaitForMultipleObjects
DrawIcon
SetWindowRgn
WaitMessage
GetSysColorBrush
GetDialogBaseUnits
UnregisterClassA
UnionRect
GetDCEx
LockWindowUpdate
GetClassNameA
SetCapture
SetTimer
ScreenToClient
ClientToScreen
GetClientRect
GetMenuItemID
PtInRect
ReleaseCapture
SetCursor
GetMenu
TranslateMessage
DispatchMessageA
GetKeyState
RedrawWindow
IsWindow
CharUpperA
CharUpperW
CharLowerA
CharLowerW
EnableWindow
LoadMenuA
GetSubMenu
GetCursorPos
KillTimer
IsWindowVisible
GetMenuItemInfoA
GetMenuItemCount
SetMenuItemInfoA
GetSysColor
LoadImageA
GetParent
GetWindowRect
UpdateWindow
PostMessageA
GetCapture
SendMessageA
GetDesktopWindow
SendDlgItemMessageA
gdi32
EnumFontFamiliesExA
Ellipse
LPtoDP
CreateEllipticRgn
CombineRgn
SetRectRgn
GetTextMetricsA
StretchDIBits
CreateFontA
GetCharWidthA
CreateHatchBrush
PlayMetaFile
EnumMetaFile
GetObjectType
PlayMetaFileRecord
SelectPalette
CreatePatternBrush
CreateDIBPatternBrushPt
ExtSelectClipRgn
PolyBezierTo
PolylineTo
PolyDraw
ArcTo
GetCurrentPositionEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
TextOutA
PtVisible
StartDocA
GetPixel
RectVisible
Rectangle
CreateRectRgnIndirect
CreateSolidBrush
DeleteDC
DeleteObject
SetStretchBltMode
StretchBlt
SetBkColor
SetMapMode
GetMapMode
CreateBitmap
ScaleWindowExtEx
GetViewportExtEx
BitBlt
SelectObject
DPtoLP
GetBitmapBits
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
PatBlt
CopyMetaFileA
SetTextColor
GetClipBox
GetDCOrgEx
CreateDCA
GetDeviceCaps
GetObjectA
GetStockObject
CreateFontIndirectA
GetTextExtentPoint32A
CreatePen
ExtCreatePen
CreateCompatibleBitmap
CreateCompatibleDC
GetBkColor
GetWindowExtEx
comdlg32
GetFileTitleA
winspool.drv
OpenPrinterA
ClosePrinter
DocumentPropertiesA
advapi32
RegCreateKeyA
GetFileSecurityA
SetFileSecurityA
RegSetValueA
BuildTrusteeWithNameA
QueryServiceStatus
GetUserNameA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
GetTokenInformation
IsValidSid
ConvertSidToStringSidA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetSidSubAuthorityCount
GetSidLengthRequired
GetSidIdentifierAuthority
InitializeSid
GetSidSubAuthority
LookupAccountSidW
LogonUserA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
CryptGenRandom
CryptAcquireContextA
CryptReleaseContext
RegOpenKeyA
RevertToSelf
OpenThreadToken
ImpersonateLoggedOnUser
QueryServiceConfigA
ControlService
StartServiceA
DeleteService
OpenSCManagerA
CreateServiceA
OpenServiceA
ChangeServiceConfigA
CloseServiceHandle
RegSetKeySecurity
RegEnumKeyExA
RegEnumValueA
RegSetValueExA
RegQueryValueExA
RegDeleteValueA
RegEnumKeyA
RegDeleteKeyA
RegCreateKeyExA
RegFlushKey
RegRestoreKeyA
RegSaveKeyA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
GetLengthSid
RegQueryValueA
RegOpenKeyExA
InitializeAcl
SetEntriesInAclA
LookupAccountNameA
FreeSid
AllocateAndInitializeSid
shell32
DragFinish
SHGetFileInfoA
ShellExecuteExA
SHFileOperationA
SHGetSpecialFolderLocation
SHGetMalloc
ExtractIconA
DragQueryFileA
ShellExecuteA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetDesktopFolder
comctl32
ImageList_ReplaceIcon
shlwapi
PathRemoveExtensionA
PathFindFileNameA
UrlUnescapeA
PathStripToRootA
PathFindExtensionA
PathIsUNCA
ole32
CreateBindCtx
ReleaseStgMedium
CoTaskMemAlloc
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTreatAsClass
StringFromGUID2
CoCreateInstance
CoCreateGuid
CoInitialize
CoUninitialize
OleDuplicateData
CoDisconnectObject
CLSIDFromString
StringFromCLSID
CoTaskMemFree
ReadClassStg
oleaut32
VarDecFromStr
VarBstrFromDec
VarBstrFromCy
SysReAllocStringLen
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayCopy
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
SafeArrayRedim
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SysStringLen
VarBstrFromDate
VarUdateFromDate
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantChangeType
VariantClear
SysStringByteLen
SysAllocStringByteLen
VariantInit
VarDateFromStr
SysAllocStringLen
SysFreeString
VarCyFromStr
GetErrorInfo
SysAllocString
SetErrorInfo
CreateErrorInfo
ws2_32
inet_ntoa
gethostbyname
gethostname
WSACleanup
WSAStartup
inet_addr
WSAGetLastError
closesocket
shutdown
recv
WSASetLastError
send
setsockopt
getsockname
ntohl
WSAEnumNetworkEvents
WSAEventSelect
htons
bind
listen
getpeername
ioctlsocket
select
htonl
connect
accept
ntohs
getservbyname
WSARecv
WSAGetOverlappedResult
WSASend
socket
WSASocketA
WSAEnumProtocolsA
gethostbyaddr
sendto
getsockopt
WSAAsyncSelect
recvfrom
WSAAsyncGetHostByName
WSAAsyncGetHostByAddr
WSAAccept
odbc32
ord18
ord59
ord68
ord44
ord50
ord51
ord5
ord46
ord40
ord11
ord4
ord72
ord19
ord12
ord3
ord47
ord13
ord43
ord16
ord10
ord49
ord48
ord8
ord20
ord61
ord14
ord9
ord15
ord23
ord1
ord2
ord41
ord17
ord25
ord45
mpr
WNetGetUserA
WNetAddConnection2A
WNetGetConnectionA
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
userenv
GetUserProfileDirectoryA
wldap32
ord22
ord45
ord60
ord143
ord13
ord191
ord135
ord16
ord204
ord41
ord301
ord27
ord200
ord79
ord38
ord34
ord35
ord33
ord32
ord26
ord50
ord195
ord51
rpcrt4
RpcStringFreeA
UuidCreate
UuidToStringA
activeds
ord13
ord15
ord9
wininet
HttpSendRequestA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetOpenA
InternetGetLastResponseInfoA
GopherFindFirstFileA
InternetCloseHandle
InternetFindNextFileA
HttpQueryInfoA
HttpAddRequestHeadersA
InternetErrorDlg
FtpGetFileA
FtpPutFileA
FtpGetCurrentDirectoryA
HttpEndRequestA
FtpRemoveDirectoryA
FtpCreateDirectoryA
FtpRenameFileA
FtpDeleteFileA
InternetQueryDataAvailable
InternetGetCookieA
InternetSetCookieA
InternetSetOptionExA
InternetQueryOptionA
InternetCanonicalizeUrlA
InternetCrackUrlA
FtpFindFirstFileA
InternetConnectA
GopherOpenFileA
InternetOpenUrlA
HttpOpenRequestA
HttpSendRequestExA
GopherGetAttributeA
FtpOpenFileA
FtpCommandA
FtpSetCurrentDirectoryA
GopherCreateLocatorA
Sections
.text Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 344KB - Virtual size: 375KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ