Analysis
-
max time kernel
16s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 07:05
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe
-
Size
3.3MB
-
MD5
ef0a3c4e7d2ac94dbac734d16663ece5
-
SHA1
391376a358bd2bc25e352edb8625bec3fc726730
-
SHA256
edd546db7acae9624a3a7df547e2ee36b6bf2360fa665baafe696c25d4b91fad
-
SHA512
2dba353553f6819101d92dce0896ffaaa2f59bf2deea2787b674eef92530543a2b0e9c7c58b26f7406ffcc70c826e0377289400d3c5ed848b90889f0d5c00c1a
-
SSDEEP
49152:6ezu5gxnwn5nF4uQ3w1Rx0/B526ChU+SyQvVBo9:0ywnBquQg1f0G9Yk
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UnRAR.dll 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe File opened for modification C:\Windows\SysWOW64\UnRAR.dll 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2700 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2700 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: 1 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeCreateTokenPrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeAssignPrimaryTokenPrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeLockMemoryPrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeIncreaseQuotaPrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeMachineAccountPrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeTcbPrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeSecurityPrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeTakeOwnershipPrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeLoadDriverPrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeSystemProfilePrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeSystemtimePrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeProfSingleProcessPrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeIncBasePriorityPrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeCreatePagefilePrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeCreatePermanentPrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeBackupPrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeRestorePrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeShutdownPrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeDebugPrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeAuditPrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeSystemEnvironmentPrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeChangeNotifyPrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeRemoteShutdownPrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeUndockPrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeSyncAgentPrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeEnableDelegationPrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeManageVolumePrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeImpersonatePrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeCreateGlobalPrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: 31 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: 32 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: 33 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: 34 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: 35 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: 36 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: 37 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: 38 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: 39 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: 40 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: 41 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: 42 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: 43 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: 44 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: 45 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: 46 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: 47 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: 48 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeDebugPrivilege 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeDebugPrivilege 2700 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: 1 2700 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeCreateTokenPrivilege 2700 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeAssignPrimaryTokenPrivilege 2700 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeLockMemoryPrivilege 2700 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeIncreaseQuotaPrivilege 2700 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeMachineAccountPrivilege 2700 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeTcbPrivilege 2700 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeSecurityPrivilege 2700 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeTakeOwnershipPrivilege 2700 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeLoadDriverPrivilege 2700 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeSystemProfilePrivilege 2700 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeSystemtimePrivilege 2700 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe Token: SeProfSingleProcessPrivilege 2700 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe 2700 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe 2700 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe 2700 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1072 wrote to memory of 2700 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe 29 PID 1072 wrote to memory of 2700 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe 29 PID 1072 wrote to memory of 2700 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe 29 PID 1072 wrote to memory of 2700 1072 2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-25_ef0a3c4e7d2ac94dbac734d16663ece5_icedid.exe"2⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
266KB
MD5dfc3a999aeec3181233395e8216937c6
SHA1bf67234eb469524e12e902c65e218b07620295a9
SHA2569e9fb1782b62918fb4e3838ad905c43f53dd5fa9694e13370731ba3ab4bf5e5d
SHA5123e002f7b8f09c3370de7ea8912f6d4a0e8e4e03c6988a3f6368cbf659bec84d937f18a948d9fa5aed409e022c1e4e0782e2583314103029e3ef0a3ab670c3dab