7339048c13b1554224ad029c1f5b55b4dc56e1c54484ff925491e1c81ede9f8e

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-24_0e0d5e68a49666c7facee2edddfc730d_icedid.exe
Size

727KB
MD5

0e0d5e68a49666c7facee2edddfc730d
SHA1

6fd668e58b50def616e739a94b9e95c73d4ff1a7
SHA256

7339048c13b1554224ad029c1f5b55b4dc56e1c54484ff925491e1c81ede9f8e
SHA512

db97699d8e2b3bf97995e1a0f93cce2a1376e713a5cc4f07ff64ec44282d2e364ff62da3edc05dd174f43e1ff677e1ba85e72fd60a0f1a9e4f0f374ce33dd274
SSDEEP

12288:aix64iBDeX3G0qulWgG1Tru26oHQxjGrygT4eoAwEjK/x0RVCDeJnO9:aixT8gGI2ly5gTEAwEjK/x0RVHtO9

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2812	13EE.tmp

Loads dropped DLL 2 IoCs

pid	Process
2964	2024-06-24_0e0d5e68a49666c7facee2edddfc730d_icedid.exe
2964	2024-06-24_0e0d5e68a49666c7facee2edddfc730d_icedid.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dplayx.dll	13EE.tmp
File created	C:\Windows\SysWOW64\msjtes40.dll	13EE.tmp
File created	C:\Windows\SysWOW64\migration\MediaPlayer-DLMigPlugin.dll	13EE.tmp
File created	C:\Windows\SysWOW64\ivfsrc.ax	13EE.tmp
File opened for modification	C:\Windows\SysWOW64\mfc110.dll	13EE.tmp
File opened for modification	C:\Windows\SysWOW64\mfc120u.dll	13EE.tmp
File created	C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\nvd3dum.dll	13EE.tmp
File opened for modification	C:\Windows\SysWOW64\mfc120.dll	13EE.tmp
File created	C:\Windows\SysWOW64\mspbde40.dll	13EE.tmp
File created	C:\Windows\SysWOW64\msrepl40.dll	13EE.tmp
File created	C:\Windows\SysWOW64\dplaysvr.exe	13EE.tmp
File created	C:\Windows\SysWOW64\ir50_32.dll	13EE.tmp
File created	C:\Windows\SysWOW64\msrd3x40.dll	13EE.tmp
File created	C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdag.dll	13EE.tmp
File opened for modification	C:\Windows\SysWOW64\vccorlib120.dll	13EE.tmp
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	13EE.tmp
File created	C:\Windows\SysWOW64\d3dxof.dll	13EE.tmp
File created	C:\Windows\SysWOW64\mfc40.dll	13EE.tmp
File created	C:\Windows\SysWOW64\msltus40.dll	13EE.tmp
File created	C:\Windows\SysWOW64\msvcrt20.dll	13EE.tmp
File created	C:\Windows\SysWOW64\FXSXP32.dll	13EE.tmp
File created	C:\Windows\SysWOW64\msorcl32.dll	13EE.tmp
File created	C:\Windows\SysWOW64\ir32_32.dll	13EE.tmp
File created	C:\Windows\SysWOW64\ir41_32.ax	13EE.tmp
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	13EE.tmp
File created	C:\Windows\SysWOW64\msexch40.dll	13EE.tmp
File created	C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdva.dll	13EE.tmp
File created	C:\Windows\SysWOW64\mswstr10.dll	13EE.tmp
File created	C:\Windows\SysWOW64\olecli32.dll	13EE.tmp
File created	C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atidxx32.dll	13EE.tmp
File created	C:\Windows\SysWOW64\iac25_32.ax	13EE.tmp
File opened for modification	C:\Windows\SysWOW64\mfc100u.dll	13EE.tmp
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	13EE.tmp
File created	C:\Windows\SysWOW64\msjter40.dll	13EE.tmp
File created	C:\Windows\SysWOW64\mstext40.dll	13EE.tmp
File created	C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igd10umd32.dll	13EE.tmp
File created	C:\Windows\SysWOW64\msjet40.dll	13EE.tmp
File created	C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\amdpcom32.dll	13EE.tmp
File created	C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\nvwgf2um.dll	13EE.tmp
File opened for modification	C:\Windows\SysWOW64\atl110.dll	13EE.tmp
File created	C:\Windows\SysWOW64\crtdll.dll	13EE.tmp
File created	C:\Windows\SysWOW64\d3dim700.dll	13EE.tmp
File created	C:\Windows\SysWOW64\dmscript.dll	13EE.tmp
File opened for modification	C:\Windows\SysWOW64\MSCOMCTL.OCX	13EE.tmp
File created	C:\Windows\SysWOW64\sqlwoa.dll	13EE.tmp
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-MediaPlayer\MediaPlayer-DLMigPlugin.dll	13EE.tmp
File created	C:\Windows\SysWOW64\audiodev.dll	13EE.tmp
File created	C:\Windows\SysWOW64\explorer.exe	13EE.tmp
File created	C:\Windows\SysWOW64\msrd2x40.dll	13EE.tmp
File opened for modification	C:\Windows\SysWOW64\msvcr120_clr0400.dll	13EE.tmp
File created	C:\Windows\SysWOW64\mswdat10.dll	13EE.tmp
File created	C:\Windows\SysWOW64\expsrv.dll	13EE.tmp
File opened for modification	C:\Windows\SysWOW64\mfc110u.dll	13EE.tmp
File created	C:\Windows\SysWOW64\msvbvm60.dll	13EE.tmp
File created	C:\Windows\SysWOW64\sqlunirl.dll	13EE.tmp
File created	C:\Windows\SysWOW64\d3d8.dll	13EE.tmp
File created	C:\Windows\SysWOW64\d3dim.dll	13EE.tmp
File opened for modification	C:\Windows\SysWOW64\mfc100.dll	13EE.tmp
File opened for modification	C:\Windows\SysWOW64\msvcr110.dll	13EE.tmp
File opened for modification	C:\Windows\SysWOW64\msvcr120.dll	13EE.tmp
File opened for modification	C:\Windows\SysWOW64\atl100.dll	13EE.tmp
File opened for modification	C:\Windows\SysWOW64\FM20.DLL	13EE.tmp
File created	C:\Windows\SysWOW64\msexcl40.dll	13EE.tmp
File created	C:\Windows\SysWOW64\InstallShield\_isdel.exe	13EE.tmp

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OISGRAPH.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Acrofx32.dll	13EE.tmp
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\JP2KLib.dll	13EE.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\ITIRCL55.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OSETUP.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FPERSON.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdate.dll	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\oisctrl.dll	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ONBttnPPT.dll	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBCONV.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\DESKSAM.SAM	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\ODBC.SAM	13EE.tmp
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe	13EE.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\GIFIMP32.FLT	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msmdlocal.dll	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GFX.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE	13EE.tmp
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Onix32.dll	13EE.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\VBAJET32.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSAEXP30.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll	13EE.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VC\msdia100.dll	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OFFOWC.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLNOTE.FAE	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1033\MSGR3EN.DLL	13EE.tmp
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.dll	13EE.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\IMPMAIL.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\TWCUTCHR.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\mset7.dll	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Wordcnv.dll	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\RM.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\MSGR3ES.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search.api	13EE.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACECORE.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ACCVDT.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\VVIEWER.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\MSVCR71.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\OUTLVBA.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\STSCOPY.DLL	13EE.tmp
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	13EE.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACERCLR.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WPFT532.CNV	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GKPowerPoint.dll	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\IEAWSDC.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OLKFSTUB.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SOA.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLJRNL.FAE	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLTASK.FAE	13EE.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEOLEDB.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\xmlrwbin.dll	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDCAT.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSOCF.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSOCFUIUTILITIESDLL.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSRTEDIT.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OARTCONV.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Updater.api	13EE.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\EXP_PDF.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll	13EE.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE	13EE.tmp

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CORPerfMonExt.dll	13EE.tmp
File created	C:\Windows\winsxs\Backup\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4a5d2c9ecd59afa7_dnscacheugc.exe_aa32623e	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-c..complus-runtime-qfe_31bf3856ad364e35_6.1.7600.16385_none_6b3984a4d9e2684a\catsrv.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\helpcins.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-windowscodec_31bf3856ad364e35_7.1.7601.16492_none_89a132998a8975e7\WindowsCodecs.dll	13EE.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.2.9600.16428_none_ffeecffc6b986ebd\mshtml.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-ie-runtimeutilities_31bf3856ad364e35_11.2.9600.16428_none_cddc21e3e934f0b3\iertutil.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-n..protection-statusui_31bf3856ad364e35_6.1.7600.16385_none_3d715a438950ce7b\NAPSTAT.EXE	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-rasclienttools_31bf3856ad364e35_6.1.7600.16385_none_6f1d25ec0a04d811\rasphone.exe	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-s..nt-configuration-ui_31bf3856ad364e35_6.1.7601.17514_none_a6011071cfb52a11\snmpsnap.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-m..-management-console_31bf3856ad364e35_6.1.7600.16385_none_0f49a133d6f5d42b\mmcshext.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_0b66cb34258c936f\cmitrust.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.4148_none_4bf5400abf9d60b7\mfc90u.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_netfx-applaunch_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_99931ad927972550\AppLaunch.exe	13EE.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-imapiv2-base_31bf3856ad364e35_6.1.7601.17514_none_2b851fa75da204a8\imapi2.dll	13EE.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_6.1.7600.16385_none_9da1b3254ff796e9\racpldlg.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-ie-gc-registeriepkeys_31bf3856ad364e35_11.2.9600.16428_none_ae214da780801b0f\RegisterIEPKEYs.exe	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-networkexplorer_31bf3856ad364e35_6.1.7601.17514_none_4259cafda42274a4\networkexplorer.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.4148_none_4bf5400abf9d60b7\mfc90.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-wmcodecdspps_31bf3856ad364e35_6.1.7600.16385_none_e344e0de5741a951\wmcodecdspps.dll	13EE.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_6.1.7600.16385_none_26e76f2ac1492952\wmprph.exe	13EE.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-mulanttsvoicecommon_31bf3856ad364e35_6.1.7600.16385_none_48330de9affd2c5d\MSTTSDecWrp.dll	13EE.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-processmodel_31bf3856ad364e35_6.1.7601.17514_none_1f3c3defefc3a10e\w3wp.exe	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-help-oemhelpins_31bf3856ad364e35_6.1.7600.16385_none_02251b880c000edf\OEMHelpIns.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-wlanconnectionflow_31bf3856ad364e35_6.1.7600.16385_none_8a0b2bb6c9253b6f\WLanConn.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_netfx-fw_netfxperf_dll_31bf3856ad364e35_6.2.7601.17514_none_5ec9dfb2784680fc\netfxperf.dll	13EE.tmp
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-a..dcredentialprovider_31bf3856ad364e35_6.1.7601.17514_none_44120ea520cf6a6d\SmartcardCredentialProvider.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-authorizationmanagerui_31bf3856ad364e35_6.1.7601.17514_none_23e160885de79241\azroleui.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-cmi_31bf3856ad364e35_6.1.7601.17514_none_abd5b433b8ccf7a4\cmiv2.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-rpc-remote_31bf3856ad364e35_6.1.7601.17514_none_c2a09d30916321d9\RpcRtRemote.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-msident_31bf3856ad364e35_6.1.7600.16385_none_17fb8f9dae097073\msident.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-security-negoexts_31bf3856ad364e35_6.1.7600.16385_none_b81643545ac42615\negoexts.dll	13EE.tmp
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.EnterpriseServices.Thunk.dll	13EE.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-a..ence-mitigations-c5_31bf3856ad364e35_6.1.7601.17514_none_74a0e9133d491d65\AcXtrnal.dll	13EE.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..ssionstaticbinaries_31bf3856ad364e35_6.1.7601.17514_none_c035b00b76d54e4f\compstat.dll	13EE.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-itvdata_31bf3856ad364e35_6.1.7601.17514_none_a7c5e761a3b1de83\iTVData.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-wmvcore_31bf3856ad364e35_6.1.7601.17514_none_0939edb934199a4a\WMVCORE.DLL	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-unimodem-config_31bf3856ad364e35_6.1.7600.16385_none_f4d7f7b17ffe522a\modemmigplugin.dll	13EE.tmp
File created	C:\Windows\winsxs\wow64_windowssearchengine_31bf3856ad364e35_7.0.7601.17514_none_dbd4d2796675bc72\mssitlb.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-dssec_31bf3856ad364e35_6.1.7600.16385_none_5a3c2da65ddb680f\dssec.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_6.1.7600.16385_none_fe75fb7856d846d5\DWWIN.EXE	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-indeo5-codecs_31bf3856ad364e35_6.1.7600.16385_none_24d6d974d24f7d95\ivfsrc.ax	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_6.1.7601.17514_none_ed47f623204af12a\logagent.exe	13EE.tmp
File created	C:\Windows\winsxs\x86_netfx-mscormmc_dll_rtm_31bf3856ad364e35_6.1.7601.17514_none_a98a0efe27a75944\mscormmc.dll	13EE.tmp
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MmcAspExt.dll	13EE.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_c79aef32ab85d92b\cmpbk32.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-m..-downlevelmanifests_31bf3856ad364e35_6.1.7601.17514_none_04801f69e1dbd8e6\MediaPlayer-DLMigPlugin.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-m..ents-mdac-rds-isapi_31bf3856ad364e35_6.1.7601.17514_none_725dd325550ed654\msadcs.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_6.1.7601.17514_none_88e35d5cb2d54359\net1.exe	13EE.tmp
File created	C:\Windows\winsxs\Backup\wow64_microsoft-windows-msxml60_31bf3856ad364e35_6.1.7601.17514_none_f0e8ac03e1d6bb5b_msxml6.dll_ebe15265	13EE.tmp
File created	C:\Windows\winsxs\Backup\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.7601.17514_none_83801b5eed6392d9_gdiplus.dll_423f7010	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-s..entication-usermode_31bf3856ad364e35_6.1.7600.16385_none_39f81956d5a8018f\authz.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-wusa_31bf3856ad364e35_6.1.7601.17514_none_af07fb6876def437\wusa.exe	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-n..rity-domain-clients_31bf3856ad364e35_6.1.7601.17514_none_1ce1e5c45077d5f2\ipsmsnap.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-w..ig-registrar-wizard_31bf3856ad364e35_6.1.7600.16385_none_3d090e2060b5b3fc\wcnwiz.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_10b2f55f9bffb8f8\msvcr80.dll	13EE.tmp
File created	C:\Windows\winsxs\Backup\wow64_microsoft-windows-uxtheme_31bf3856ad364e35_6.1.7600.16385_none_0c2e36cd54a163b4_uxtheme.dll_9f6cda06	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-cryptui-dll_31bf3856ad364e35_6.1.7601.17514_none_87f5c549f6656c22\cryptui.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-dxptasks-ringtone_31bf3856ad364e35_6.1.7601.17514_none_b0945a7f704488ee\DXPTaskRingtone.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-m..mdac-sql-netlibs-np_31bf3856ad364e35_6.1.7600.16385_none_eeb24528dbcb8823\dbnmpntw.dll	13EE.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_6.1.7601.17514_none_affb336d34ccf2f8\unregmp2.exe	13EE.tmp
File created	C:\Windows\winsxs\Backup\wow64_microsoft-windows-w..sition-coreservices_31bf3856ad364e35_6.1.7600.16385_none_98ddd70b016524a9_sti.dll_d93e8a42	13EE.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-htmlhelp_31bf3856ad364e35_6.1.7600.16385_none_2e9f92abd2ce43b6\hhctrl.ocx	13EE.tmp

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2964	2024-06-24_0e0d5e68a49666c7facee2edddfc730d_icedid.exe
2964	2024-06-24_0e0d5e68a49666c7facee2edddfc730d_icedid.exe
2964	2024-06-24_0e0d5e68a49666c7facee2edddfc730d_icedid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2812	2964	2024-06-24_0e0d5e68a49666c7facee2edddfc730d_icedid.exe	28
PID 2964 wrote to memory of 2812	2964	2024-06-24_0e0d5e68a49666c7facee2edddfc730d_icedid.exe	28
PID 2964 wrote to memory of 2812	2964	2024-06-24_0e0d5e68a49666c7facee2edddfc730d_icedid.exe	28
PID 2964 wrote to memory of 2812	2964	2024-06-24_0e0d5e68a49666c7facee2edddfc730d_icedid.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-24_0e0d5e68a49666c7facee2edddfc730d_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-24_0e0d5e68a49666c7facee2edddfc730d_icedid.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\13EE.tmp
  C:\Users\Admin\AppData\Local\Temp\13EE.tmp
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\13EE.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdobeARM.log

Filesize
148B

MD5
a87fc8ac0f01e4f7480d6f9f9dfbfa0f

SHA1
70cc46c204b65a0133f7ae94c1c5d8abda90d6ad

SHA256
a2b7645548f17f134b191fee6f4740b16286884ebe4fc1505d390757c70e3988

SHA512
ff0358e829e81f34b42df32dfd3959606352fbcb25ba4091a7ec2f61b29e756cb4cc054a816ee5824c839d8c5ffddbb4d5caea3a96cac7f86d0bc2522b41381f

Download Submit
memory/2964-0-0x0000000000320000-0x0000000000370000-memory.dmp

Filesize
320KB

Download