88e70a334f8ca4efca533735daef6ea4e831454ecfc964fb95897f6af15780c8

General

Target
2024-06-08_37d7c0390a82d0df0391e5f8164fdd41_icedid_zxxz.exe
Size 15.2MB
Sample240608-m77chabh83
SHA256 88e70a334f8ca4efca533735daef6ea4e831454ecfc964fb95897f6af15780c8
MD5 37d7c0390a82d0df0391e5f8164fdd41
SHA1 5e887f076a1e1a2e063d1e324bc6bbcc7912a31a
SHA512 2639b5cac1a9fb2fc8dcd6566c88d0c1496d6b72e4226206f4e33eec258569a15a02454fd562a7824b97d30e57b4974b79b289c7fd5832ad1d9e12ce1472cb70
SSDEEP 393216:i/krIE1jXPSZ4zuFMc3Oh1CPwv3uzAQwR4hIL:i/krIEZPSKz1ceRTR4g
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023428-7.dat	UPX
behavioral2/files/0x0008000000023424-11.dat	UPX
behavioral2/memory/2016-13-0x00000000737D0000-0x0000000074499000-memory.dmp	UPX
behavioral2/memory/2016-20-0x0000000000400000-0x0000000000CCA000-memory.dmp	UPX
behavioral2/memory/2016-21-0x00000000737D0000-0x0000000074499000-memory.dmp	UPX
behavioral2/memory/2016-22-0x0000000000400000-0x0000000000CCA000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0008000000023424-11.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
2016	ÉÏºÅÆ÷.exe

Loads dropped DLL 2 IoCs

pid	Process
2016	ÉÏºÅÆ÷.exe
2016	ÉÏºÅÆ÷.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023424-11.dat	upx
behavioral2/memory/2016-13-0x00000000737D0000-0x0000000074499000-memory.dmp	upx
behavioral2/memory/2016-21-0x00000000737D0000-0x0000000074499000-memory.dmp	upx

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Base.dll	ÉÏºÅÆ÷.exe
File created	C:\Windows\SysWOW64\TestLF.dll	ÉÏºÅÆ÷.exe
File created	C:\Windows\SysWOW64\libeay32.dll	ÉÏºÅÆ÷.exe
File opened for modification	C:\Windows\SysWOW64\TestLF.dll	ÉÏºÅÆ÷.exe
File opened for modification	C:\Windows\SysWOW64\Base.dll	ÉÏºÅÆ÷.exe
File opened for modification	C:\Windows\SysWOW64\libeay32.dll	ÉÏºÅÆ÷.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1572	2016	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1068	2024-06-08_37d7c0390a82d0df0391e5f8164fdd41_icedid_zxxz.exe
1068	2024-06-08_37d7c0390a82d0df0391e5f8164fdd41_icedid_zxxz.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1068	2024-06-08_37d7c0390a82d0df0391e5f8164fdd41_icedid_zxxz.exe
1068	2024-06-08_37d7c0390a82d0df0391e5f8164fdd41_icedid_zxxz.exe
2016	ÉÏºÅÆ÷.exe
2016	ÉÏºÅÆ÷.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 2016	1068	2024-06-08_37d7c0390a82d0df0391e5f8164fdd41_icedid_zxxz.exe	80
PID 1068 wrote to memory of 2016	1068	2024-06-08_37d7c0390a82d0df0391e5f8164fdd41_icedid_zxxz.exe	80
PID 1068 wrote to memory of 2016	1068	2024-06-08_37d7c0390a82d0df0391e5f8164fdd41_icedid_zxxz.exe	80
PID 2016 wrote to memory of 1304	2016	ÉÏºÅÆ÷.exe	81
PID 2016 wrote to memory of 1304	2016	ÉÏºÅÆ÷.exe	81
PID 2016 wrote to memory of 1304	2016	ÉÏºÅÆ÷.exe	81
PID 2016 wrote to memory of 60	2016	ÉÏºÅÆ÷.exe	83
PID 2016 wrote to memory of 60	2016	ÉÏºÅÆ÷.exe	83
PID 2016 wrote to memory of 60	2016	ÉÏºÅÆ÷.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-06-08_37d7c0390a82d0df0391e5f8164fdd41_icedid_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-08_37d7c0390a82d0df0391e5f8164fdd41_icedid_zxxz.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Users\Admin\AppData\Local\Temp\ÉÏºÅÆ÷.exe
  C:\Users\Admin\AppData\Local\Temp/ÉÏºÅÆ÷.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\SysWOW64\netsh.exe
    netsh int ipv4 set dynamicport tcp start=10000 num=55000
    3⤵
    PID:1304
- - C:\Windows\SysWOW64\netsh.exe
    netsh int ipv6 set dynamicport tcp start=10000 num=55000
    3⤵
    PID:60
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 1008
    3⤵
    - Program crash
    PID:1572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2016 -ip 2016
1⤵
PID:4072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

ExuiKrnln_Win32.lib

Path C:\Users\Admin\AppData\Local\Temp\ExuiKrnln_Win32.lib
Size 1.8MB
SHA256 57d3dc22e25539ee0838e3a00a719b9b731fd4d054649c640d053f57e957a5bc
MD5 fc6166f515a9eb7c47803064cfede8cd
SHA1 23397c3f6a42230c82c0a9fc34e7c3893c4034ea
SHA512 4d3dea7556aadce0c1bbb8f5a76ea46161fbec4ed8369a781c1953f8d0ea50615a2b41098ec30beb834743a104d3711fd9fc28bfc10e9c359f6ba5e85ca33eb2
SSDEEP 24576:lRPJUmNWYcOwlxfcZM3NFk49uo85LcCxBOtnbTfv:vJUmNWY/KuZM3NFk49uo85LLBOtbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sunny.dll

Path C:\Users\Admin\AppData\Local\Temp\Sunny.dll
Size 4.1MB
SHA256 ca26ee48c0a83c753a62288b18370b6495356afcf24d9847b92666263706510a
MD5 55b3ce3a121ab710f38d122bd6a012bf
SHA1 7497a252e2388e65de2298da80ff0ef31a02e096
SHA512 4164c3e19367b0e018a5dd562febfadb2cb5f1389f5c6c54b155e6838982cbb959d9d5bc026130bcc21b3843aa79cea284606c16ae7c10a86a73e4c55f7890d9
SSDEEP 98304:+1e8OLMPSIgApQ4OM/fRnuOhUX40tBPxtA8tTg3xKRepc3:ajXPSIK4z/NuHDPxFIxcepc3
MD5 SHA1 SHA512 SSDEEP

Submit Download

ÉÏºÅÆ÷.exe

Path C:\Users\Admin\AppData\Local\Temp\ÉÏºÅÆ÷.exe
Size 8.5MB
SHA256 9c44eb1da580bfc65cd4f3c043b5dc1067584b0e81d31a926a731016b9ceaab1
MD5 a8e9b614f61fb392b9ccffa84b2a9d83
SHA1 930f69b0b8eedcd798668b6a9237e089d205c7d6
SHA512 ff691c0c5f2b91d4ae7c9923994af23aeba44727f0189cb6cff6364d7dd830cbf775351e162dd0330785b9ccadf4c0b33e9686a33e5a7bc965cb1257b0222296
SSDEEP 196608:PsfiK/CtyaIRva1CPwv3ugugOwQwnRs7z9aj3eNjhIgtEOb:rh1CPwv3uzAQwR4hIi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2016-13-0x00000000737D0000-0x0000000074499000-memory.dmp

Download

memory/2016-20-0x0000000000400000-0x0000000000CCA000-memory.dmp

Download

memory/2016-21-0x00000000737D0000-0x0000000074499000-memory.dmp

Download

memory/2016-22-0x0000000000400000-0x0000000000CCA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads