2024-08-20_e48fc5ad59b499d1139ac1b81d236226_eternalromance_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2024-08-20_e48fc5ad59b499d1139ac1b81d236226_eternalromance_icedid
Size 19.0MB
Sample240820-lkbfwavbrf
SHA256 7888da83e656ef9282edd4e2c5ea4e48526915c711dd3814d544b6af021d910d
MD5 e48fc5ad59b499d1139ac1b81d236226
SHA1 d6a535aaa78dbf1883f09ccd146c500913f42d25
SHA512 0ba737b00d3adae3d2a10b9438a505f757834e123c348dc5efa6aade992b8f4bef5f6587d83880e2493158257c07f2bda6751229827a2a367693e5c85f7a57ea
SSDEEP 393216:+I6hTG5G866Gf2CsTnRZMZmOpT4c0nHXAbAK5OP:eTUG86HsReZmOpT4c4X02
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-08-20_e48fc5ad59b499d1139ac1b81d236226_eternalromance_icedid

.exe 19.0MB

2024-08-20_e48fc5ad59b499d1139ac1b81d236226_eternalromance_icedid

IMPHASH 8483f41d4a59bcbf7f0de7e1b18ca20a
SHA256 7888da83e656ef9282edd4e2c5ea4e48526915c711dd3814d544b6af021d910d
MD5 e48fc5ad59b499d1139ac1b81d236226
SHA1 d6a535aaa78dbf1883f09ccd146c500913f42d25
SHA512 0ba737b00d3adae3d2a10b9438a505f757834e123c348dc5efa6aade992b8f4bef5f6587d83880e2493158257c07f2bda6751229827a2a367693e5c85f7a57ea
SSDEEP 393216:+I6hTG5G866Gf2CsTnRZMZmOpT4c0nHXAbAK5OP:eTUG86HsReZmOpT4c4X02
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

d7:fa:be:32:8b:7c:71:ab:73:b3:c4:45:49:73:9f:74:3d:eb:4d:64

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=SGA Co.\,LTD,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=SGA Co.\,LTD,L=Seocho-gu,ST=SEOUL,C=KR

Chains

Jan 23, 2014

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=SGA Co.\,LTD,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=SGA Co.\,LTD,L=Seocho-gu,ST=SEOUL,C=KR

Serial Number

56:8d:28:98:36:41:d5:18:f2:19:f7:1a:c9:79:56:d5

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 2, 2012 - Nov 1, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

88483

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTimeZoneInformation GetSystemTime GetLocalTime GetSystemTimeAsFileTime RtlUnwind HeapFree HeapAlloc GetDriveTypeA GetStartupInfoA ExitProcess RaiseException HeapReAlloc HeapSize GetACP GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr LCMapStringA LCMapStringW FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetStringTypeA GetStringTypeW SetUnhandledExceptionFilter SetStdHandle IsBadReadPtr IsBadCodePtr CompareStringA CompareStringW SetEnvironmentVariableA GetProfileStringA GetFileTime FileTimeToLocalFileTime FileTimeToSystemTime GetFullPathNameA GetVolumeInformationA SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer DuplicateHandle SetErrorMode GetOEMCP GetCPInfo GetThreadLocale GetCurrentDirectoryA WritePrivateProfileStringA GlobalFlags TlsGetValue LocalReAlloc TlsSetValue GlobalReAlloc TlsFree GlobalHandle TlsAlloc LocalAlloc lstrcpynA MulDiv SetLastError GetVersion lstrcatA GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalUnlock GlobalFree GlobalLock GlobalAlloc GlobalDeleteAtom lstrcmpA GetCurrentThread GetCurrentThreadId MultiByteToWideChar lstrlenA InterlockedDecrement InterlockedIncrement WideCharToMultiByte GetUserDefaultLangID GetModuleFileNameA GetSystemInfo FindResourceA SizeofResource LoadResource LockResource GetCurrentProcess GetVersionExA GetModuleHandleA lstrcmpiA GetTickCount CreateProcessA SetEvent GetProcessVersion OpenProcess GetExitCodeProcess TerminateProcess CreateMutexA LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection Sleep MoveFileExA GetTempPathA LoadLibraryA GetProcAddress FreeLibrary WriteFile ReadFile CreateFileA GetFileSize FindFirstFileA FindNextFileA DeleteFileA FindClose RemoveDirectoryA GetFileAttributesA MoveFileA GetCommandLineA GetSystemDirectoryA CreateEventA WaitForSingleObject CloseHandle GetLastError FormatMessageA lstrcpyA CreateDirectoryA LocalFree UnhandledExceptionFilter

user32

UpdateWindow SendDlgItemMessageA MapWindowPoints GetSysColor SetFocus AdjustWindowRectEx ScreenToClient CopyRect GetTopWindow IsChild GetCapture WinHelpA wsprintfA GetClassInfoA RegisterClassA GetMenu GetMenuItemCount GetSubMenu GetMenuItemID GetWindowTextLengthA GetWindowTextA GetDlgCtrlID CreateWindowExA GetClassLongA SetPropA UnhookWindowsHookEx GetPropA CallWindowProcA RemovePropA DefWindowProcA GetMessageTime GetMessagePos GetForegroundWindow SetForegroundWindow SetWindowLongA OffsetRect IntersectRect GetWindowPlacement GetWindowRect MapDialogRect SetWindowPos GetWindow SetWindowContextHelpId EndDialog SetActiveWindow IsWindow CreateDialogIndirectParamA DestroyWindow GetDlgItem GetMenuCheckMarkDimensions LoadBitmapA CharUpperA ModifyMenuA SetMenuItemBitmaps DispatchMessageA TranslateMessage PeekMessageA UnregisterClassA HideCaret ShowCaret ExcludeUpdateRgn DrawFocusRect CheckMenuItem EnableMenuItem GetFocus GetNextDlgTabItem GetMessageA GetActiveWindow GetKeyState CallNextHookEx ValidateRect IsWindowVisible GetCursorPos SetWindowsHookExA GetParent GetLastActivePopup IsWindowEnabled GetWindowLongA MessageBoxA SetCursor PostQuitMessage LoadStringA EnableWindow IsIconic GetSystemMetrics GetClientRect DrawIcon IsDialogMessageA MoveWindow ClientToScreen PostThreadMessageA RegisterWindowMessageA SendMessageA PostMessageA DefDlgProcA IsWindowUnicode LoadIconA ShowWindow RegisterClipboardFormatA InvalidateRect InflateRect DestroyMenu MessageBeep GetNextDlgGroupItem SetRect CopyAcceleratorTableA CharNextA GetSysColorBrush PtInRect GetClassNameA GetDesktopWindow LoadCursorA GrayStringA DrawTextA GetMenuState TabbedTextOutA EndPaint BeginPaint GetWindowDC ReleaseDC SystemParametersInfoA GetDC SetWindowTextA

gdi32

GetDeviceCaps GetViewportExtEx GetWindowExtEx IntersectClipRect CreateSolidBrush PtVisible RectVisible TextOutA ExtTextOutA Escape GetTextColor GetBkColor DPtoLP LPtoDP GetMapMode PatBlt ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode SetBkMode GetStockObject SelectObject RestoreDC SaveDC DeleteDC GetObjectA SetBkColor SetTextColor GetClipBox CreateBitmap CreateDIBitmap GetTextExtentPointA BitBlt CreateCompatibleDC DeleteObject

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA ClosePrinter DocumentPropertiesA

advapi32

RegCloseKey RegOpenKeyExA RegEnumValueA RegEnumKeyA RegDeleteKeyA RegOpenKeyA RegDeleteValueA RegSetValueExA RegCreateKeyExA RegQueryValueExA QueryServiceStatus OpenProcessToken LookupPrivilegeValueA DuplicateTokenEx SetTokenInformation AdjustTokenPrivileges CreateProcessAsUserA ControlService StartServiceA CreateServiceA OpenSCManagerA OpenServiceA CloseServiceHandle

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHGetMalloc

comctl32

ord17

oledlg

ord8

ole32

CoTaskMemAlloc CoTaskMemFree CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject OleIsCurrentClipboard CLSIDFromString CLSIDFromProgID OleUninitialize CoFreeUnusedLibraries OleInitialize CoRegisterMessageFilter CoRevokeClassObject OleFlushClipboard

olepro32

ord253

oleaut32

VariantCopy VariantTimeToSystemTime VariantClear SysAllocStringLen SysFreeString SysAllocString SysAllocStringByteLen SysStringLen VariantChangeType

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

psapi

GetModuleFileNameExA EnumProcesses EnumProcessModules

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

Sharing

General

Malware Config

Signatures

File Explorer

2024-08-20_e48fc5ad59b499d1139ac1b81d236226_eternalromance_icedid

PE Signature issue

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

userenv

psapi

version

generic