2024-08-25_24c1a81caa52c5506902af67399c9603_hijackloader_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2024-08-25_24c1a81caa52c5506902af67399c9603_hijackloader_icedid
Size 9.0MB
Sample240825-lk29laygnn
SHA256 3c3928b7b8029c0879e2ef9bcba326dd713d19c0c98192c7913a3a4b7bf5e35f
MD5 24c1a81caa52c5506902af67399c9603
SHA1 da96dab45ac9212c23216019f2a1cf0130cf4313
SHA512 027ae370a2c7ad5f4ba07fca246ba756b30e02708f7577aa1f133faa853edb4782471fed5fe1a9de444b4433aff10059e49050677a6d1d7b18b8d5d3b38c18bf
SSDEEP 196608:nmY+gpsEi8BwJYkigWpqO5V7PZ0X3JU+0ZeyQq706:PsYeJYkzOTjKXq+mQT6
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-08-25_24c1a81caa52c5506902af67399c9603_hijackloader_icedid

.exe 9.0MB

2024-08-25_24c1a81caa52c5506902af67399c9603_hijackloader_icedid

IMPHASH 230363beee3a16b40f8fefab5ba42a93
SHA256 3c3928b7b8029c0879e2ef9bcba326dd713d19c0c98192c7913a3a4b7bf5e35f
MD5 24c1a81caa52c5506902af67399c9603
SHA1 da96dab45ac9212c23216019f2a1cf0130cf4313
SHA512 027ae370a2c7ad5f4ba07fca246ba756b30e02708f7577aa1f133faa853edb4782471fed5fe1a9de444b4433aff10059e49050677a6d1d7b18b8d5d3b38c18bf
SSDEEP 196608:nmY+gpsEi8BwJYkigWpqO5V7PZ0X3JU+0ZeyQq706:PsYeJYkzOTjKXq+mQT6
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

fe:77:e9:ac:6c:2d:1c:cf:eb:16:68:4d:92:d2:5c:89:c0:35:c3:bb:66:cd:34:14:8f:db:2c:b7:92:c8:40:ef

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=MB Oyun Yazilim ve Pazarlama AS,O=MB Oyun Yazilim ve Pazarlama AS,L=Sariyer,C=TR

Chains

Jan 11, 2024

CN=MB Oyun Yazilim ve Pazarlama AS,O=MB Oyun Yazilim ve Pazarlama AS,L=Sariyer,C=TR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=MB Oyun Yazilim ve Pazarlama AS,O=MB Oyun Yazilim ve Pazarlama AS,L=Sariyer,C=TR

Serial Number

ed:a4:00:ef:ce:e2:8e:ac:48:38:a7:f4:7c:24:1c:2a

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 22, 2021 - Jun 21, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

183228

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InitializeCriticalSection TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree GetModuleHandleW SetErrorMode WritePrivateProfileStringA GlobalFlags GetCPInfo GetOEMCP GetSystemTimeAsFileTime RtlUnwind Sleep ExitProcess HeapFree HeapAlloc RaiseException HeapReAlloc SetEnvironmentVariableA SetCurrentDirectoryA GetCommandLineA GetStartupInfoA VirtualAlloc HeapSize GetACP IsValidCodePage TerminateProcess GlobalHandle SetUnhandledExceptionFilter IsDebuggerPresent GetTimeZoneInformation LCMapStringA LCMapStringW GetStdHandle InitializeCriticalSectionAndSpinCount SetHandleCount GetFileType GetConsoleCP GetConsoleMode HeapCreate VirtualFree CompareStringW SetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetStringTypeA GetStringTypeW WriteConsoleA GetConsoleOutputCP WriteConsoleW GetProcessHeap GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc GetFileTime GetFileSizeEx SetFileTime SystemTimeToFileTime LocalFileTimeToFileTime GlobalGetAtomNameA GlobalFindAtomA lstrcmpW GetVersionExA GetCurrentProcessId GlobalAddAtomA FreeResource GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesA GetLocaleInfoA LoadLibraryExA CompareStringA GetCurrentProcess DuplicateHandle SetEndOfFile UnlockFile LockFile FlushFileBuffers WriteFile LoadLibraryA lstrcmpA FreeLibrary InterlockedDecrement GetModuleFileNameW GetModuleHandleA GetProcAddress GlobalFree GlobalAlloc GlobalLock GlobalUnlock MultiByteToWideChar MulDiv SetLastError SetVolumeLabelA GetCurrentDirectoryA GetDiskFreeSpaceA GetDriveTypeA MoveFileA CreateDirectoryA GetFileSize FormatMessageA LocalFree UnmapViewOfFile CreateFileMappingA MapViewOfFile GetTempPathA GetModuleFileNameA lstrlenA lstrcpyA CreateProcessA GetLastError GetExitCodeProcess SetFileAttributesA DeleteFileA RemoveDirectoryA GetFileAttributesA GetFullPathNameA GetVolumeInformationA InterlockedIncrement FindNextFileA FindFirstFileA FindClose FileTimeToLocalFileTime FileTimeToSystemTime CreateFileA SetFilePointer ReadFile InterlockedExchange CloseHandle WideCharToMultiByte FindResourceA LoadResource LockResource UnhandledExceptionFilter SizeofResource

user32

UnregisterClassA GetSysColorBrush EndPaint BeginPaint ClientToScreen GrayStringA DrawTextExA DrawTextA TabbedTextOutA RegisterWindowMessageA WinHelpA GetCapture GetClassLongA GetClassNameA SetPropA GetPropA RemovePropA GetForegroundWindow GetTopWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow UpdateWindow CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA GetSysColor PtInRect DefWindowProcA CallWindowProcA GetMenu SystemParametersInfoA GetWindowPlacement GetWindowRect GetWindowThreadProcessId GetLastActivePopup SetWindowsHookExA CallNextHookEx GetMessageA IsWindowVisible GetKeyState GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapA ModifyMenuA EnableMenuItem CheckMenuItem ReleaseDC GetDC CopyRect GetDesktopWindow GetActiveWindow SetActiveWindow CreateDialogIndirectParamA DestroyWindow GetNextDlgTabItem EndDialog GetWindowTextA PostQuitMessage PeekMessageA IsWindow CharUpperA GetFocus GetParent SetWindowPos SetFocus IsWindowEnabled ShowWindow SetWindowLongA GetDlgCtrlID SetWindowTextA GetWindowLongA IsDialogMessageA DestroyMenu AdjustWindowRectEx SendMessageA DrawIcon PostMessageA IsIconic GetClientRect LoadCursorA LoadIconA EnableWindow GetSystemMetrics SetCursor DispatchMessageA TranslateMessage MsgWaitForMultipleObjects wsprintfA MessageBoxA OemToCharBuffA CharToOemBuffA GetSubMenu GetMenuItemCount SendDlgItemMessageA GetDlgItem GetWindow UnhookWindowsHookEx GetMenuState GetMenuItemID

gdi32

DeleteDC GetStockObject SetWindowExtEx ScaleWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutA TextOutA RectVisible GetDeviceCaps DeleteObject SetMapMode RestoreDC SaveDC GetObjectA SetBkColor SetTextColor GetClipBox CreateBitmap PtVisible

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

advapi32

RegSetValueExA RegCreateKeyExA RegQueryValueA RegEnumKeyA RegDeleteKeyA RegOpenKeyExA RegOpenKeyA RegQueryValueExA RegCloseKey

shell32

SHFileOperationA

shlwapi

PathIsUNCA PathFindFileNameA PathFindExtensionA PathStripToRootA

oleaut32

VariantClear VariantChangeType VariantInit

Sharing

General

Malware Config

Signatures

File Explorer

2024-08-25_24c1a81caa52c5506902af67399c9603_hijackloader_icedid

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

oleaut32

generic