3c3928b7b8029c0879e2ef9bcba326dd713d19c0c98192c7913a3a4b7bf5e35f

Analysis

max time kernel
140s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 09:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-08-25_24c1a81caa52c5506902af67399c9603_hijackloader_icedid.exe
Size 9.0MB
Sample240825-lk29laygnn
SHA256 3c3928b7b8029c0879e2ef9bcba326dd713d19c0c98192c7913a3a4b7bf5e35f
MD5 24c1a81caa52c5506902af67399c9603
SHA1 da96dab45ac9212c23216019f2a1cf0130cf4313
SHA512 027ae370a2c7ad5f4ba07fca246ba756b30e02708f7577aa1f133faa853edb4782471fed5fe1a9de444b4433aff10059e49050677a6d1d7b18b8d5d3b38c18bf
SSDEEP 196608:nmY+gpsEi8BwJYkigWpqO5V7PZ0X3JU+0ZeyQq706:PsYeJYkzOTjKXq+mQT6
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	autorun.exe

Executes dropped EXE 1 IoCs

pid	Process
3576	autorun.exe

Loads dropped DLL 4 IoCs

pid	Process
3576	autorun.exe
3576	autorun.exe
3576	autorun.exe
3576	autorun.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-25_24c1a81caa52c5506902af67399c9603_hijackloader_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	autorun.exe

Checks processor information in registry 2 TTPs 1 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	autorun.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3576	autorun.exe
3576	autorun.exe
3576	autorun.exe
3576	autorun.exe
3576	autorun.exe
3576	autorun.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3576	autorun.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1720	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1720	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4476	2024-08-25_24c1a81caa52c5506902af67399c9603_hijackloader_icedid.exe
4476	2024-08-25_24c1a81caa52c5506902af67399c9603_hijackloader_icedid.exe
3576	autorun.exe
3576	autorun.exe
3576	autorun.exe
3576	autorun.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 3576	4476	2024-08-25_24c1a81caa52c5506902af67399c9603_hijackloader_icedid.exe	84
PID 4476 wrote to memory of 3576	4476	2024-08-25_24c1a81caa52c5506902af67399c9603_hijackloader_icedid.exe	84
PID 4476 wrote to memory of 3576	4476	2024-08-25_24c1a81caa52c5506902af67399c9603_hijackloader_icedid.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-08-25_24c1a81caa52c5506902af67399c9603_hijackloader_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-25_24c1a81caa52c5506902af67399c9603_hijackloader_icedid.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\autorun.exe
  "C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\autorun.exe" "SFXSOURCE:C:\Users\Admin\AppData\Local\Temp\2024-08-25_24c1a81caa52c5506902af67399c9603_hijackloader_icedid.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3576

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x308 0x2c4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

btnkapat.btn

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Buttons\btnkapat.btn
Size 2KB
SHA256 71a648090997f2f854972f40531d13cb5aded056a9d0b57fbb9dc4db60fe5efa
MD5 67c351d9e4bdeb9cea0cc9490297dad9
SHA1 6579e88be941fb3b0fceeff652d3ded2eabcb58c
SHA512 88041613d02ac26b3de4f2bfc474469f5c8efec1e0bbb43c3cfd2c6cc646ee12233323f4c9245c08fff39544ba380c19168a8c3168179ad69b7678d81d9c3948
MD5 SHA1 SHA512

Submit Download

btnsimge.btn

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Buttons\btnsimge.btn
Size 1KB
SHA256 12b112de0021ac3214b768ef7ce1c10959aa14bbe4442fb332c5dd81d63b95a0
MD5 35a7e4a24ac8d0e0d548a99e4410e6bb
SHA1 01f8c2a9111c4be299b0623eeaf7e260837e6bcc
SHA512 1ec222ceb5dd8cb9c17b4adc08c91b2866a057f09a765c65d465ad081f6c7f8e649f25939cdf5165ef12527e220b54f5f6fd0f423aa47774bdba86ee5d25962f
MD5 SHA1 SHA512

Submit Download

btnuyeol.btn

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Buttons\btnuyeol.btn
Size 8KB
SHA256 7b72e988da0e65f385117782be9c84c5a7435812245ae638837c26de51fc62cb
MD5 2a1e950b279c7db27cefb275387530dd
SHA1 f118763389d4f432404c8254b4061213f2aaeced
SHA512 e3f789b7b665518ac115a45c6efbdc795ebb8804e71a0393e225541ca1fedb2b4fc87307ef6dba384182b140a3880f9fd3be674948e72884e51d5cabc528acdd
SSDEEP 192:8/ZCRP/BtRx/ZASE9x0NSeKDRAOnLfOjF4AdhdXfreN:80pBtRxM4SeKDRAg444daN
MD5 SHA1 SHA512 SSDEEP

Submit Download

esra_logo.btn

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Buttons\esra_logo.btn
Size 2KB
SHA256 a932f2641107ee1d889f8742c625a919290654c85e828e57a5b321b5595fd1e0
MD5 4f602f60c6425b79a6f001e9c42523e8
SHA1 159fc3bee3847a63bc7b4f0727df5fb5efd6dde7
SHA512 4dfd2c9d81e2299c0f398bec9a53e7bc3e23a746e3dd31095cdf0740689cd6984356297b36157b7ee7ba74901cbb9409082e3b493e89da2a4fed5b6cdb8273fe
MD5 SHA1 SHA512

Submit Download

madbyte_logo.btn

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Buttons\madbyte_logo.btn
Size 5KB
SHA256 92dac629289c475991e2454f307b938b1baed9bd93758fed79b97707833d75ee
MD5 0f3f3a9974fbd99d72e29f6c811ccfd0
SHA1 3ab0c968f29636b064d1e93fe0c9f0b22f7137f4
SHA512 c41217f8277263005f1e19207ed59670781acc7c083fbfd52d570f5f5962ff8536a1ae950e09d54c5eb484050c7f50b1751f0a59de2d5bd60d1838e328bf2259
SSDEEP 96:rZhODDTdQ5vchNvFNa6UNoB1phbCx82O/1mFcXynPhQSdSZBm:rZhsxQVc3vjaubm61mp5QSeo
MD5 SHA1 SHA512 SSDEEP

Submit Download

sourenagames_logo.btn

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Buttons\sourenagames_logo.btn
Size 2KB
SHA256 68a9df4c470c86ef24914da652dca71c798fe78248d4d33ccdca513602e95ba4
MD5 48e85ccedd8a641b249e7207e285fcc0
SHA1 b04f1feb2db1518edbd51634790a2297d6b6ba0a
SHA512 d4d4e99f7a1e1ab06a60499b4e8847853aeb166cca514fa2417458e6d08bbfb7b908c4d88b041f75c371c1c4de542901ca0f22ab2ebf9479a3f9fd2898e4705a
MD5 SHA1 SHA512

Submit Download

lang-1-9.xml

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Docs\lang-1-9.xml
Size 2KB
SHA256 6aaa07c584611049c3fab9092e9baf37f67a4227eb417372504aeb7bdfe03c82
MD5 069ffd4079ece57eb7a6619397cccab1
SHA1 3a18b43638e1b23260aa163a9604247cd8d56fbb
SHA512 5afa7877ebf6cedab606462d05cdcea8cc3ff711e80c5ffcafa6b7a753221f5c9ad29b102659e228b53040515cb6d92a505931618f42de9324f05d9792203110
MD5 SHA1 SHA512

Submit Download

lang-3-1.xml

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Docs\lang-3-1.xml
Size 2KB
SHA256 761d9e96273a8e3cf623b726e6dc4ea2ae40fb4d2725cba0efcd04f73bed95b0
MD5 ca2af68319febc2333a79425a7329bc0
SHA1 b444d160ccb4ce9b5bec51a693517f98f4b88094
SHA512 67d6015748547e9b2cf0fbd0afb75b284c62197e5bd75046d189164534be8db613970f2452168465d03e213e8c761fc74d3b0c24b7ace9c90fb344d05ce5f753
MD5 SHA1 SHA512

Submit Download

lang-31.xml

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Docs\lang-31.xml
Size 2KB
SHA256 e11978e20837e4f5eaab81efac82d8b763db76191da2d9dd32d417956f9a1f70
MD5 5b03ae0d49319907e10df4d0104bb3d0
SHA1 9143c62c45f9bb5b463199307479d706433fc679
SHA512 9ed3a65db49eb57c46c0ff528bf5035e12e3b088308e31541cd2845516794d87222dedb1cdd7d38419a3e7328512d7cf7ac7977cae23867a10be22c202a3942e
MD5 SHA1 SHA512

Submit Download

background.png

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Images\background.png
Size 140KB
SHA256 a383c4a7fb6fd94f3fb35c2bfdabd577cd3412f87eada2df58a9d03a64675748
MD5 17b9edafaa382c2167b407bd67de683c
SHA1 1bb0ce042f4c1436ea9965e61c268b0071d3dc9a
SHA512 59778e5f8e7528713caa725af6f1e37b0572dd455d4b9c04b81d1f704aa047760393343c6a31568f1da4a39c8d24809077256645006832b6fb40a62a98685538
SSDEEP 3072:pDyilcOxzasND5r9/QVlY+cl71gFvXipMGmJukPXFLO9:HcOssNDpiGTp6XiGhK9
MD5 SHA1 SHA512 SSDEEP

Submit Download

red_bar.png

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Images\red_bar.png
Size 19KB
SHA256 491409e67d69143be809a112fd29d48d365dc915474a0a20a964673812fc90c8
MD5 d06af89d4da8efd642732c2d379ac782
SHA1 018aaf15804ca0fe1afa706abc00bcd073888b9e
SHA512 b4ef8ef1b54e165d316b5b597e4214a5edf95ad9819be6946bcf20b7d46e17b814968450b9ce5ceecdbb1f005206c16886d9b3e0c710bdfcfccd520dadfa4437
SSDEEP 96:/SDZ/I09Da01l+gmkyTt6Hk8nTwvWvkiqnNGeMZE2nkffGfNXrNXVhsc5K0P:/SDS0tKg9E05T/kigf/aMQ58c
MD5 SHA1 SHA512 SSDEEP

Submit Download

red_bar_bg.png

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Images\red_bar_bg.png
Size 25KB
SHA256 ac6b891001f6aba84c350340b3486f357133e93f910bad80ddd12347e65ab2c4
MD5 e2934febfa4553af7d31d128fd7220ed
SHA1 2a9721fdf10f897634dd58286ca9915a19d113b5
SHA512 b4fba678b2e921eaf8523cfbd6f4b3dd781cf576e38dfb3e80c83924c9a9a90d019b398de810ac759f25598612d04d912eeed5b021ac4994a490b63fd9faae85
SSDEEP 96:GSDZ/I09Da01l+gmkyTt6Hk8nTqckEWmTB1xNXrNXNsc5FWN:GSDS0tKg9E05Thk6TBv5a
MD5 SHA1 SHA512 SSDEEP

Submit Download

taban_alpha.bmp

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Images\taban_alpha.bmp
Size 558KB
SHA256 c67480137524fa3eaf028e3ac2dd0274063809577643a0f2663fe473658f59e7
MD5 f1ab8d32dd46d6bc2066c15c99711dac
SHA1 b85e7e131b7e623f52da1c975f09ff2d29213f20
SHA512 b0bdea0e9aea02577133b36640a7a05b85e51c569ca079d14d1e8bec087c1e23c183eeb511eea0cfab47308fc7da8918e24140afbba02968ed420aaee064c0c1
SSDEEP 24:HLcTaduzFjGJJnRj7eRJraARFz4NuYoGl9+oEGAANLUm71slhnkADH+:HLEWJfoXz4NuY3JyJkB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Download.lmd

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Plugins\Download\Download.lmd
Size 208KB
SHA256 3820b72388506cc90b7bbd1852fb7961a2d1e95409d7c17ec6f271d8088593d9
MD5 75506a09a72783d3317fee4cb35ee88a
SHA1 f2c8fab84647709747ed6e7d9e9dbfbde3ea3c34
SHA512 d7f7961c1f8782b543194c66dccf8d6b5fe48b7786457fbe79fe336437a71d92619d66206e7364e5be8c9a0859b9cfdb5d650676d694171e186512d2cab38adb
SSDEEP 3072:JkZDnv9bPDCkj7wl3ap2ZR/ql/ZTk4j2iFJcB+OQE+lkdzuDGaZ/pbnk:Av9b5j794SlBTk4bXcsudVaZhbnk
MD5 SHA1 SHA512 SSDEEP

Submit Download

JSON.lmd

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Plugins\JSON\JSON.lmd
Size 220KB
SHA256 d662c12b21d966f1e7682dcef6ac21eff9667186ba3613f8f842d6b035507d48
MD5 88b5737462eb234926526237079354f0
SHA1 92edde7d067991318ddf64b6c9a095fa08163cf5
SHA512 f1e32608ea96db1f2a8c2bd556dbaf92f46c53aa3ef4c90cc459905002a45bb8c45227476fd78c2a5a80c0101125f43c972546092f0925f0e1cf6c0121ad00a7
SSDEEP 3072:SpYb1se8KLs30yoOVODwYLQYRpe8JB77gh7Qgd52J05IuDh1dnG:5b1rLs30y/VO0YkYRnJZshvGGuYdnG
MD5 SHA1 SHA512 SSDEEP

Submit Download

autorun.cdd

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\autorun.cdd
Size 3.5MB
SHA256 2f1b36ad6b28fe98414dea500167af45882bbe30219938fe98fc95b3ff5c9b7a
MD5 96731f15afb7a742b46b1028cfde8709
SHA1 579b427f7a91e75f1042891408015997eec6a818
SHA512 8570cd375aa37bb307a4110a47b7bd94397516cba42d1f597048315aef7e0734ce6fa4cf7b80b2ec6037a271d5f0b2711869c2002208daae8af2c8ce8d4cf534
SSDEEP 98304:5wJbLB4mri6V/UWv3zLp1cGsgwWi+vdvWSRNlFOKz+l:5w9LBbJS4zd1bspcFvnOiA
MD5 SHA1 SHA512 SSDEEP

Submit Download

autorun.exe

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\autorun.exe
Size 6.3MB
SHA256 919c4f71e28deb8827603ac566a9f865717cf7cd40d5c2bf4488ccf0a1cbff0b
MD5 3acd1e6fba6017bb32a4b4f40d4891fd
SHA1 5ebe5d7b7ac946eb9ce338d464c5238afe61d4c2
SHA512 b3d98b4ccd3b2d01b9e078efa362570e4dd6f3e11c7cd963249ec0a8c898e5dc885c51ef58f27ad5f74b1cb744f48825f51a8050f5d45d9e1a695a7798dcd177
SSDEEP 196608:n6f7fuTsiBUobarFq9A26lwojD390brVBp0:6f7fxY9ABpDC0
MD5 SHA1 SHA512 SSDEEP

Submit Download

lua5.1.dll

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\lua5.1.dll
Size 327KB
SHA256 ebeb211dfe4fce993d63206b2e3f284b569274db4730a8ee341ee81eccac9a5f
MD5 50f1d9f2093914c7712068608f3d66f2
SHA1 c38c655526b9ba929f01259cd35abb65744448f0
SHA512 07841d260770288f34b3e6413f6044742d82794d0812d9d58ebb2b881f935ee7661c94acddcf3a25817a98168789de0e0e0a98baaddbac2ec097a3efdd22c9ac
SSDEEP 6144:lpF7LK5bwfYggoCQxltnoqhMQ3WxAOj+JzOgmX:N7Igvnoz0Wx8xA
MD5 SHA1 SHA512 SSDEEP

Submit Download

zula.ico

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\zula.ico
Size 164KB
SHA256 430bb095f247258077c46479529174caec9a0fb620445a2ceaa3e3d7310f393f
MD5 d480ff567ce958d389dcad4bfc3a6959
SHA1 17480500037643aec0d716b63c686fd666bc6f9b
SHA512 7aa8f05a0ace175d8801f191d5e03dd104d8c9f4e2d9d16105dc65cb948ac2f1b8b13f4545de580164dc8e7703297b1ce558942e499197f99733ba6da62bd6ec
SSDEEP 3072:WfyHwEXirS2DbpuONcbMERAOlYpK77BDYkF:aISr8ONcbp2QSK7l5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3576-225-0x0000000003F40000-0x0000000003F7E000-memory.dmp

Download