icedid | icedlicense[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
icedlicense.dll
Size 352KB
Sample240729-l58bcasemk
SHA256 d45b3f9d93171c29a51f9c8011cd61aa44fcb474d59a0b68181bb690dbbf2ef5
MD5 11965662e146d97d3fa3288e119aefb2
SHA1 b63d7ad26df026f6cca07eae14bb10a0ddb77f41
SHA512 06594c479e2291afd92a0c65c41045304284c46105b28a5ef66f0c82c5842e5dd7d257a7a291ea72846307ece18fd36376488b2f35a6c14b71d2bd2fbe808c64
SSDEEP 6144:tlKrvv+ji9a/DvJiasRASnilvy1fj2YbOe1sOPKW+8kRLWZrL:ur+jsa/Dv8asRBnid+fjjbMOPKW+zRLG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

core_payload icedid

Malware Config

Extracted

Family

icedid

rsa_pubkey.plain

Signatures

Icedid family
icedid

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
icedlicense.dll

File Explorer

icedlicense.dll

.dll 352KB

icedlicense.dll

IMPHASH a8fc15ab07f233aa3f87f33c0fe09875
SHA256 d45b3f9d93171c29a51f9c8011cd61aa44fcb474d59a0b68181bb690dbbf2ef5
MD5 11965662e146d97d3fa3288e119aefb2
SHA1 b63d7ad26df026f6cca07eae14bb10a0ddb77f41
SHA512 06594c479e2291afd92a0c65c41045304284c46105b28a5ef66f0c82c5842e5dd7d257a7a291ea72846307ece18fd36376488b2f35a6c14b71d2bd2fbe808c64
SSDEEP 6144:tlKrvv+ji9a/DvJiasRASnilvy1fj2YbOe1sOPKW+8kRLWZrL:ur+jsa/Dv8asRBnid+fjjbMOPKW+zRLG
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

gdiplus

GdipSaveImageToFile GdipDisposeImage GdipCreateBitmapFromHBITMAP GdiplusStartup

netapi32

NetWkstaGetInfo NetGetJoinInformation NetApiBufferFree

user32

ReleaseDC GetWindowDC GetDesktopWindow GetForegroundWindow CharLowerA wsprintfW wsprintfA GetCursorPos GetWindowRect

shlwapi

StrStrIW StrCmpNIW StrToIntA StrToIntExA StrCmpNIA StrStrIA StrStrA SHSetValueA StrCmpIW PathFindFileNameA StrChrW StrChrA

crypt32

CertEnumCertificatesInStore CertAddCertificateContextToStore CertControlStore CertGetIntendedKeyUsage CertGetNameStringA CertCreateSelfSignCertificate CertGetCertificateContextProperty CryptSignAndEncodeCertificate CryptEncodeObject CryptExportPublicKeyInfoEx CertStrToNameA CryptUnprotectData CertCloseStore CertFreeCertificateContext CertDuplicateCertificateContext CertCreateCertificateContext CertSetCertificateContextProperty CertOpenStore

gdi32

GetStockObject SelectObject Ellipse DeleteObject DeleteDC CreatePen CreateCompatibleBitmap BitBlt CreateCompatibleDC

ntdll

ZwQuerySystemInformation RtlGetVersion NtWriteVirtualMemory NtProtectVirtualMemory RtlTimeToSecondsSince1970 RtlDecompressBuffer NtAllocateVirtualMemory

winhttp

WinHttpCrackUrl WinHttpQueryOption WinHttpReadData WinHttpQueryDataAvailable WinHttpOpen WinHttpSetOption WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpSetStatusCallback WinHttpConnect WinHttpCloseHandle

rpcrt4

UuidFromStringW UuidFromStringA

ws2_32

accept WSAGetLastError setsockopt send select closesocket inet_ntoa WSAStartup connect ioctlsocket listen bind recv socket WSACreateEvent WSAEnumNetworkEvents WSAEventSelect gethostbyname WSASetLastError shutdown inet_addr

advapi32

LookupAccountNameW RegOpenKeyExA RegQueryValueExA CryptAcquireContextA CredFree CredEnumerateW RegQueryValueExW RegEnumKeyExA RegCreateKeyExA CryptGenKey CryptVerifySignatureA InitiateSystemShutdownExA CryptImportKey CryptDestroyKey LookupPrivilegeValueA AdjustTokenPrivileges RegEnumValueA RegDeleteValueA RegSetValueExA RegOpenKeyA RegDeleteKeyA RegCreateKeyA ConvertSidToStringSidA CryptAcquireContextW GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority GetSidIdentifierAuthority OpenProcessToken GetUserNameW GetUserNameA CryptDestroyHash CryptReleaseContext CryptGetHashParam RegCloseKey CryptCreateHash CryptHashData

oleaut32

SysAllocStringLen SysStringLen SysFreeString

shell32

ShellExecuteExA SHGetFolderPathW SHGetFolderPathA

secur32

InitSecurityInterfaceA

ole32

CoInitializeEx CoInitialize CoCreateInstance CoTaskMemFree

kernel32

GetWindowsDirectoryA GetSystemDirectoryA ResumeThread UnregisterWait RegisterWaitForSingleObject CreateRemoteThread GetFileSize FindNextFileA FindFirstFileA FindClose CreateFileW ExpandEnvironmentStringsA MultiByteToWideChar DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection QueueUserAPC SleepEx CreateEventW CreateFileA OpenProcess TerminateThread CreateThread OpenEventA CreateEventA SetEvent CopyFileA lstrcmpiA DeleteFileA GetTickCount64 WideCharToMultiByte IsWow64Process CreateProcessA TerminateProcess WaitForSingleObject HeapReAlloc PeekNamedPipe CreatePipe WriteFile SystemTimeToFileTime FreeLibrary LoadLibraryA LocalAlloc DeleteFileW SetFilePointer SetErrorMode GetProcAddress ReadFile LocalFree GetNativeSystemInfo GetComputerNameExW GetTickCount SwitchToThread QueryPerformanceFrequency QueryPerformanceCounter lstrlenW lstrcatW lstrcatA GetTempPathA GetTempPathW CreateDirectoryW CreateDirectoryA lstrlenA GetLocalTime GetCurrentProcessId OutputDebugStringA lstrcpyA GetProductInfo ExitProcess CreateMutexA GetSystemTimeAsFileTime GetSystemTime Sleep CloseHandle GetModuleHandleA GetProcessHeap HeapFree GetLastError HeapAlloc WaitForMultipleObjects

msvcrt

_vsnprintf memset memcpy

iphlpapi

GetAdaptersInfo