Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15-06-2024 11:28
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe
-
Size
2.3MB
-
MD5
d5c2f96bdb737ed828f8585988cc5f39
-
SHA1
947b5680beea102d99f3425277d0b812aa28fd55
-
SHA256
8ede84109b78394b42ead5f872791601ccd8c52806ece2fbf30922f7d1694c83
-
SHA512
c94f4d6de14fb1db0c9ef33c1aa550ea6a03939fccbf99d9a1c49e775566f8041f321e7ea02ce8d266575580ad629fe11d2f5a18cf7d90077fa4ebee1735f44c
-
SSDEEP
49152:zmzOUMZYppNNWCsVb6KUpZ+hDg1F2d6bXkVaW4m/:UOU6YpB5SbWf+YFC8kVafe
Malware Config
Signatures
-
Detects executables packed with VMProtect. 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1856-54-0x0000000002580000-0x0000000002594000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/1856-57-0x0000000002580000-0x0000000002594000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral2/memory/1856-95-0x0000000002580000-0x0000000002594000-memory.dmp INDICATOR_EXE_Packed_VMProtect -
UPX dump on OEP (original entry point) 32 IoCs
Processes:
resource yara_rule behavioral2/memory/1856-0-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral2/memory/1856-1-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral2/memory/1856-11-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral2/memory/1856-13-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral2/memory/1856-35-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral2/memory/1856-41-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral2/memory/1856-44-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral2/memory/1856-39-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral2/memory/1856-37-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral2/memory/1856-33-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral2/memory/1856-31-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral2/memory/1856-27-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral2/memory/1856-25-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral2/memory/1856-23-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral2/memory/1856-21-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral2/memory/1856-19-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral2/memory/1856-17-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral2/memory/1856-15-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral2/memory/1856-9-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral2/memory/1856-7-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral2/memory/1856-5-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral2/memory/1856-29-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral2/memory/1856-3-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral2/memory/1856-2-0x0000000010000000-0x000000001003E000-memory.dmp UPX C:\Windows\SysWOW64\dm.dll UPX behavioral2/memory/808-53-0x0000000010000000-0x0000000010176000-memory.dmp UPX behavioral2/memory/1856-54-0x0000000002580000-0x0000000002594000-memory.dmp UPX behavioral2/memory/1856-57-0x0000000002580000-0x0000000002594000-memory.dmp UPX behavioral2/memory/1856-58-0x0000000002790000-0x0000000002906000-memory.dmp UPX behavioral2/memory/1856-78-0x0000000002790000-0x0000000002906000-memory.dmp UPX behavioral2/memory/1856-86-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral2/memory/1856-95-0x0000000002580000-0x0000000002594000-memory.dmp UPX -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Windows\SysWOW64\dm.dll acprotect -
Loads dropped DLL 3 IoCs
Processes:
regsvr32.exe2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exepid process 808 regsvr32.exe 1856 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe 1856 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe -
Processes:
resource yara_rule behavioral2/memory/1856-0-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1856-1-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1856-11-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1856-13-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1856-35-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1856-41-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1856-44-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1856-39-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1856-37-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1856-33-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1856-31-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1856-27-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1856-25-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1856-23-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1856-21-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1856-19-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1856-17-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1856-15-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1856-9-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1856-7-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1856-5-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1856-29-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1856-3-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1856-2-0x0000000010000000-0x000000001003E000-memory.dmp upx C:\Windows\SysWOW64\dm.dll upx behavioral2/memory/808-53-0x0000000010000000-0x0000000010176000-memory.dmp upx behavioral2/memory/1856-54-0x0000000002580000-0x0000000002594000-memory.dmp upx behavioral2/memory/1856-57-0x0000000002580000-0x0000000002594000-memory.dmp upx behavioral2/memory/1856-58-0x0000000002790000-0x0000000002906000-memory.dmp upx behavioral2/memory/1856-78-0x0000000002790000-0x0000000002906000-memory.dmp upx behavioral2/memory/1856-86-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1856-95-0x0000000002580000-0x0000000002594000-memory.dmp upx -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exedescription ioc process File opened for modification \??\PhysicalDrive0 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe -
Drops file in System32 directory 2 IoCs
Processes:
2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exedescription ioc process File created C:\Windows\SysWOW64\dm.dll 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe File opened for modification C:\Windows\SysWOW64\dm.dll 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe -
Drops file in Windows directory 2 IoCs
Processes:
2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exedescription ioc process File created C:\WINDOWS\Edm.dll 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe File opened for modification C:\WINDOWS\Edm.dll 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe -
Modifies registry class 37 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib\ = "{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\ = "dm.dmsoft" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\ProgID\ = "dm.dmsoft" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InprocServer32\ = "C:\\WINDOWS\\Edm.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib\ = "{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ = "Idmsoft" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CurVer\ = "dm.dmsoft" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\ = "dm.dmsoft" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\ = "Dm" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\HELPDIR\ = "C:\\WINDOWS\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ = "Idmsoft" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CLSID\ = "{26037A0E-7CBD-4FFF-9C63-56F2D0770214}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\0\win32\ = "C:\\WINDOWS\\Edm.dll" regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exedescription pid process Token: SeDebugPrivilege 1856 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe Token: SeDebugPrivilege 1856 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exepid process 1856 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe 1856 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe 1856 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exedescription pid process target process PID 1856 wrote to memory of 808 1856 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe regsvr32.exe PID 1856 wrote to memory of 808 1856 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe regsvr32.exe PID 1856 wrote to memory of 808 1856 2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-15_d5c2f96bdb737ed828f8585988cc5f39_icedid.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\WINDOWS\Edm.dll2⤵
- Loads dropped DLL
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\×¢²áÂëÅäÖÃ.iniFilesize
46B
MD5e1cf753d2f06b22fecd7666eebfeb1f3
SHA16f18eb498649cb74b7919e906c514ac7be8478d1
SHA256f7797bb407faffad4835edee7350b66a829e26ca4646cc76b5616939b78433a5
SHA5122484098f9736e3005ca90c1684979dd7301dcdf44d132f2606a105786428b0c7cb1c43ab9f1dbbd1d87a13f74bfdaaf5568b5200dff0f2d2b7c54f0e589540ef
-
C:\Windows\SysWOW64\dm.dllFilesize
804KB
MD5c578b6820bda5689940560147c6e5ffc
SHA1922e50d89c9c44bdc205ef17aa57212b64e58852
SHA2563b6ddc32b800a18b21a819e842cbfdd57cb065fd92cc69545e0ef29b97cfd389
SHA5129f2a1bb5788ad245242d12968bbf198af2694a87c6e2342f14672e8c14e8489dd3319434592fc9b20f620557d0fa58482903d19c7f5ba32456a1e4076dc1bb85
-
memory/808-53-0x0000000010000000-0x0000000010176000-memory.dmpFilesize
1.5MB
-
memory/1856-37-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1856-41-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1856-9-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1856-44-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1856-39-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1856-0-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1856-33-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1856-31-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1856-27-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1856-25-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1856-23-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1856-21-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1856-19-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1856-17-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1856-95-0x0000000002580000-0x0000000002594000-memory.dmpFilesize
80KB
-
memory/1856-35-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1856-7-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1856-5-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1856-29-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1856-3-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1856-2-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1856-13-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1856-11-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1856-54-0x0000000002580000-0x0000000002594000-memory.dmpFilesize
80KB
-
memory/1856-57-0x0000000002580000-0x0000000002594000-memory.dmpFilesize
80KB
-
memory/1856-58-0x0000000002790000-0x0000000002906000-memory.dmpFilesize
1.5MB
-
memory/1856-1-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1856-78-0x0000000002790000-0x0000000002906000-memory.dmpFilesize
1.5MB
-
memory/1856-86-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1856-15-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB