Behavioral task
behavioral1
Sample
2024-07-02_7288bb74f6162f4c9d0b5d518b0a4181_icedid.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-07-02_7288bb74f6162f4c9d0b5d518b0a4181_icedid.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-07-02_7288bb74f6162f4c9d0b5d518b0a4181_icedid
-
Size
14KB
-
MD5
7288bb74f6162f4c9d0b5d518b0a4181
-
SHA1
f1d0f7fc247134e7430746d603fa28afacfc3088
-
SHA256
eb48c54eb5cfbd00fb55e13de35c147f407d3f962a09961534e12eda1391bae2
-
SHA512
b3b55fc74403b0b1fc24fba9d364c7c24935ed6fdd0d6d26f12478481f808b40277f2199548a9dc28244534e45bf827c4d7cfda6730f9cebfb1225958237e67a
-
SSDEEP
192:eC+YPv6UOyDqZ1KcMzqTHG+3F+j7rT9z7VYe/7Vd/5A27E0mgGn9f:eev6UbqZ1K7zX+3q7PEe/7Vd227E0lMx
Malware Config
Extracted
icedid
Signatures
-
Icedid family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2024-07-02_7288bb74f6162f4c9d0b5d518b0a4181_icedid
Files
-
2024-07-02_7288bb74f6162f4c9d0b5d518b0a4181_icedid.exe windows:6 windows x64 arch:x64
3a0cfb574e9f4ca8db6893e099e2d5bb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
GetUserNameW
LookupAccountNameW
winhttp
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpOpen
WinHttpSetStatusCallback
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpConnect
kernel32
WideCharToMultiByte
lstrlenW
VirtualProtect
VirtualAlloc
lstrcatA
lstrcpyA
Sleep
GetTempPathA
CreateDirectoryA
LoadLibraryA
GetProcAddress
GetComputerNameExW
ExitProcess
HeapAlloc
HeapFree
GetProcessHeap
CreateFileA
WriteFile
CloseHandle
HeapReAlloc
GetLastError
SwitchToThread
GetTickCount64
shell32
SHGetFolderPathA
msvcrt
memset
user32
wsprintfW
Sections
.c Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 512B - Virtual size: 6B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 512B - Virtual size: 396B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.r Size: 512B - Virtual size: 416B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.d Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE