2024-08-24_7620e776b1553dd055e0dc161eb21528_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-24_7620e776b1553dd055e0dc161eb21528_icedid
Size

2.4MB
MD5

7620e776b1553dd055e0dc161eb21528
SHA1

2ed440454341d7eda1027a2af2d6da885d25b4f2
SHA256

3f5f3c0f053ab3c6887e39d3cf2d897d8e2ec5016f2d64512c03f83bae2bea37
SHA512

0139fd26c3773c848cc366d8f3cb8da12baa752f81ae3493a1270ab7ef866e1c74b4467877121f347cdf2df7ea1e3937d8250c8a3def2f27aab4130c19a0ca32
SSDEEP

24576:xytT1jOi7m+vBqiHsOJqgY8cOTfVvG4SY5FpSMWdY5/WgPMVkQ4FVTjbp/Su7Kr:YYgBNO4FSHc/Wcwf4nTPp/Su7

Score

1^/10

Malware Config

Signatures

Files

2024-08-24_7620e776b1553dd055e0dc161eb21528_icedid
.exe windows:4 windows x86 arch:x86

c77d5a2faf125cdf6adb57ec3dea201a

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6f:95:aa:cf:8b:e7:53:6a:05:37:11:b7
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

29/08/2023, 09:03

Not After

29/08/2025, 09:03

Subject

SERIALNUMBER=759614-V,CN=Securemetric Technology Sdn. Bhd.,OU=Technology,O=Securemetric Technology Sdn. Bhd.,STREET=L5-E-06 Level 5 Enterprise 4\, Technology Park Malaysia,L=Kuala Lumpur,ST=Kuala Lumpur,C=MY,1.2.840.113549.1.9.1=#0c18737570706f7274407365637572656d65747269632e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024d59,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:45

Not After

08/05/2033, 07:45

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d8:75:8d:05:dc:6d:ce:94:6c:27:89:3e:89:6b:09:18:8b:7c:6e:cd
Signer

Actual PE Digest

d8:75:8d:05:dc:6d:ce:94:6c:27:89:3e:89:6b:09:18:8b:7c:6e:cd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetWindowDC
ClientToScreen
UpdateWindow
SendDlgItemMessageW
SendDlgItemMessageA
MapWindowPoints
GetSysColor
SetFocus
AdjustWindowRectEx
IsWindowVisible
ScrollWindow
GetScrollInfo
SetScrollInfo
ShowScrollBar
SetScrollPos
GetTopWindow
MessageBoxW
IsChild
WinHelpW
RegisterClassW
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetWindowTextLengthW
GetWindowTextW
GetKeyState
CreateWindowExW
SetWindowsHookExW
CallNextHookEx
SetPropW
UnhookWindowsHookEx
GetPropW
CallWindowProcW
RemovePropW
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
GetWindow
BeginPaint
RegisterWindowMessageW
OffsetRect
SystemParametersInfoW
GetWindowPlacement
GetNextDlgTabItem
EndDialog
GrayStringW
DestroyWindow
GetWindowLongW
GetDlgItem
IsWindowEnabled
GetDC
ReleaseDC
DrawTextW
DefWindowProcW
DrawFrameControl
RedrawWindow
MapDialogRect
GetIconInfo
MessageBoxA
GetFocus
MessageBeep
SetForegroundWindow
GetSystemMenu
EnableMenuItem
DestroyIcon
GetActiveWindow
PostMessageW
SendMessageW
GetClientRect
wsprintfW
FindWindowW
IsWindow
GetWindowRect
WindowFromDC
SetWindowRgn
UnregisterClassW
GetProcessWindowStation
GetUserObjectInformationW
EnableWindow
SetDlgItemTextW
IsDialogMessageW
EndPaint
SetWindowLongW
TabbedTextOutW
PtInRect
GetCursorPos
ScreenToClient
GetCapture
GetParent
LoadIconW
GetDlgCtrlID
MoveWindow
ShowWindow
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuW
GetMenuState
LoadBitmapW
GetMenuCheckMarkDimensions
WindowFromPoint
PostQuitMessage
ValidateRect
TranslateMessage
GetMessageW
SetWindowContextHelpId
DestroyMenu
LoadStringW
GetClassNameW
GetDesktopWindow
GetSysColorBrush
CharNextW
CopyAcceleratorTableW
SetRect
GetNextDlgGroupItem
CopyRect
DrawStateW
SetWindowPos
SetActiveWindow
GetClassInfoW
SetWindowTextW
InvalidateRect
SetCursor
LoadCursorW
DrawTextExW
CloseWindow
KillTimer
DrawIcon
GetSystemMetrics
IsIconic
CharUpperW
RegisterClipboardFormatW
PostThreadMessageW
CreateDialogIndirectParamW
PeekMessageW
DispatchMessageW
SetTimer

gdi32

DPtoLP
GetTextColor
GetBkColor
LPtoDP
GetMapMode
Escape
ExtTextOutW
TextOutW
PtVisible
GetWindowExtEx
GetViewportExtEx
GetDeviceCaps
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
CreateFontIndirectW
SetTextColor
SetBkMode
RectVisible
CreateBitmap
SetBkColor
SaveDC
GetClipBox
CreateRectRgnIndirect
ExtSelectClipRgn
SetStretchBltMode
SetDIBitsToDevice
RestoreDC
CreateDIBSection
DeleteDC
PatBlt
CreateDCW
CreateSolidBrush
GetTextExtentPoint32W
CreateCompatibleBitmap
SelectObject
GetStockObject
CreateRoundRectRgn
CreateCompatibleDC
GetObjectW
BitBlt
DeleteObject

kernel32

GetProcessVersion
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
GlobalFlags
lstrcmpiW
CreateEventW
SetThreadPriority
SetEvent
lstrcmpW
lstrcpynW
WritePrivateProfileStringW
GetThreadLocale
SetErrorMode
DuplicateHandle
CreateFileW
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
FindClose
FindFirstFileW
GetFullPathNameW
FileTimeToLocalFileTime
GetTickCount
GetFileAttributesW
GetFileSize
GetFileTime
GetStartupInfoW
ExitProcess
RtlUnwind
HeapFree
HeapAlloc
CreateThread
ExitThread
MoveFileA
RaiseException
GetTimeZoneInformation
HeapReAlloc
TerminateProcess
HeapSize
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentStrings
GetCommandLineA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
SetStdHandle
LCMapStringA
LCMapStringW
IsBadCodePtr
CreateFileA
GetCPInfo
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeA
GetStringTypeW
SetConsoleCtrlHandler
GetLocaleInfoW
CompareStringA
CompareStringW
GetACP
GetOEMCP
SetEnvironmentVariableA
InterlockedExchange
GetCurrentProcessId
GlobalMemoryStatus
QueryPerformanceCounter
FlushConsoleInputBuffer
GetVolumeInformationW
GetCurrentThreadId
MultiByteToWideChar
Sleep
GetLocalTime
WideCharToMultiByte
FindResourceW
GetModuleHandleW
FreeLibrary
GetProcAddress
LoadLibraryW
IsBadReadPtr
lstrcpyW
CloseHandle
SystemTimeToFileTime
LoadLibraryA
WaitForSingleObject
GetLastError
SuspendThread
ResumeThread
CreateMutexW
GetCommandLineW
GetTempPathA
OutputDebugStringA
CreateDirectoryA
SetLastError
FormatMessageA
GetModuleFileNameW
GetCurrentProcess
GetWindowsDirectoryW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
LocalFree
LocalAlloc
GetCurrentThread
CopyFileW
GetTempPathW
SizeofResource
LoadResource
GetSystemTime
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
CompareFileTime
GlobalUnlock
GlobalLock
GlobalAlloc
LockResource
GlobalFree
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
lstrcatW
GetVersion
lstrlenA
GetModuleHandleA
MulDiv
lstrlenW
InterlockedIncrement
InterlockedDecrement
FormatMessageW

advapi32

RegQueryValueExW
RegCloseKey
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExA
RegOpenKeyExA

ole32

CoRevokeClassObject
CoRegisterMessageFilter
OleIsCurrentClipboard
CoCreateGuid
OleFlushClipboard
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CoTaskMemAlloc
CoTaskMemFree
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID

oleaut32

SysStringLen
SysAllocString
VariantChangeType
VariantCopy
VariantTimeToSystemTime
VariantClear
OleCreateFontIndirect
SysAllocStringLen
SysFreeString

comctl32

ImageList_Destroy
ord17
_TrackMouseEvent

comdlg32

GetOpenFileNameW
GetSaveFileNameW
GetFileTitleW

shell32

ShellExecuteW
ShellExecuteExW
ord680
SHGetFolderPathW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

ctl3d32

ord16
ord13
ord24
ord6
ord25
ord21
ord22
ord3
ord12

crypt32

CertVerifyTimeValidity
CryptHashCertificate
CertGetNameStringW
CertCreateCertificateContext
CertFreeCertificateContext

oledlg

OleUIBusyW

ws2_32

WSASetLastError
shutdown
accept
connect
getsockopt
inet_addr
gethostbyname
recvfrom
sendto
send
closesocket
ntohl
WSAGetLastError
ioctlsocket
__WSAFDIsSet
select
htons
setsockopt
socket
WSAStartup
recv

shlwapi

PathIsDirectoryA
PathFileExistsW

msimg32

AlphaBlend

msvcrt

_vsnprintf
_stat
fputs
_getch

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 356KB - Virtual size: 352KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 520KB - Virtual size: 516KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c77d5a2faf125cdf6adb57ec3dea201a

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

6f:95:aa:cf:8b:e7:53:6a:05:37:11:b7Certificate

Extended Key Usages

Key Usages

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6aCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

d8:75:8d:05:dc:6d:ce:94:6c:27:89:3e:89:6b:09:18:8b:7c:6e:cdSigner

Headers

File Characteristics

Imports

user32

gdi32

kernel32

advapi32

ole32

oleaut32

comctl32

comdlg32

shell32

winspool.drv

ctl3d32

crypt32

oledlg

ws2_32

shlwapi

msimg32

msvcrt

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 356KB - Virtual size: 352KB

.data Size: 128KB - Virtual size: 191KB

.rsrc Size: 520KB - Virtual size: 516KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

6f:95:aa:cf:8b:e7:53:6a:05:37:11:b7
Certificate

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

d8:75:8d:05:dc:6d:ce:94:6c:27:89:3e:89:6b:09:18:8b:7c:6e:cd
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 356KB - Virtual size: 352KB

.data
Size: 128KB - Virtual size: 191KB

.rsrc
Size: 520KB - Virtual size: 516KB