Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-06-2024 11:28

General

  • Target

    2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe

  • Size

    2.3MB

  • MD5

    d5c2f96bdb737ed828f8585988cc5f39

  • SHA1

    947b5680beea102d99f3425277d0b812aa28fd55

  • SHA256

    8ede84109b78394b42ead5f872791601ccd8c52806ece2fbf30922f7d1694c83

  • SHA512

    c94f4d6de14fb1db0c9ef33c1aa550ea6a03939fccbf99d9a1c49e775566f8041f321e7ea02ce8d266575580ad629fe11d2f5a18cf7d90077fa4ebee1735f44c

  • SSDEEP

    49152:zmzOUMZYppNNWCsVb6KUpZ+hDg1F2d6bXkVaW4m/:UOU6YpB5SbWf+YFC8kVafe

Malware Config

Signatures

  • Detects executables packed with VMProtect. 3 IoCs
  • UPX dump on OEP (original entry point) 32 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 3 IoCs
  • UPX packed file 32 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 37 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1856
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s C:\WINDOWS\Edm.dll
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      PID:808

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\×¢²áÂëÅäÖÃ.ini
    Filesize

    46B

    MD5

    e1cf753d2f06b22fecd7666eebfeb1f3

    SHA1

    6f18eb498649cb74b7919e906c514ac7be8478d1

    SHA256

    f7797bb407faffad4835edee7350b66a829e26ca4646cc76b5616939b78433a5

    SHA512

    2484098f9736e3005ca90c1684979dd7301dcdf44d132f2606a105786428b0c7cb1c43ab9f1dbbd1d87a13f74bfdaaf5568b5200dff0f2d2b7c54f0e589540ef

  • C:\Windows\SysWOW64\dm.dll
    Filesize

    804KB

    MD5

    c578b6820bda5689940560147c6e5ffc

    SHA1

    922e50d89c9c44bdc205ef17aa57212b64e58852

    SHA256

    3b6ddc32b800a18b21a819e842cbfdd57cb065fd92cc69545e0ef29b97cfd389

    SHA512

    9f2a1bb5788ad245242d12968bbf198af2694a87c6e2342f14672e8c14e8489dd3319434592fc9b20f620557d0fa58482903d19c7f5ba32456a1e4076dc1bb85

  • memory/808-53-0x0000000010000000-0x0000000010176000-memory.dmp
    Filesize

    1.5MB

  • memory/1856-37-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

  • memory/1856-41-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

  • memory/1856-9-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

  • memory/1856-44-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

  • memory/1856-39-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

  • memory/1856-0-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

  • memory/1856-33-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

  • memory/1856-31-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

  • memory/1856-27-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

  • memory/1856-25-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

  • memory/1856-23-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

  • memory/1856-21-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

  • memory/1856-19-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

  • memory/1856-17-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

  • memory/1856-95-0x0000000002580000-0x0000000002594000-memory.dmp
    Filesize

    80KB

  • memory/1856-35-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

  • memory/1856-7-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

  • memory/1856-5-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

  • memory/1856-29-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

  • memory/1856-3-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

  • memory/1856-2-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

  • memory/1856-13-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

  • memory/1856-11-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

  • memory/1856-54-0x0000000002580000-0x0000000002594000-memory.dmp
    Filesize

    80KB

  • memory/1856-57-0x0000000002580000-0x0000000002594000-memory.dmp
    Filesize

    80KB

  • memory/1856-58-0x0000000002790000-0x0000000002906000-memory.dmp
    Filesize

    1.5MB

  • memory/1856-1-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

  • memory/1856-78-0x0000000002790000-0x0000000002906000-memory.dmp
    Filesize

    1.5MB

  • memory/1856-86-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

  • memory/1856-15-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB