7f12fa435226f4012b6a04af3a4a22031796491cf8bdd92e0db940adc122fa51

General

Target

2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe
Size

13.8MB
MD5

7b15cc96d9b59c40bfc1cb2a409a91bc
SHA1

350dcaa8df80e7c316d02fa8993b7adb1b823065
SHA256

7f12fa435226f4012b6a04af3a4a22031796491cf8bdd92e0db940adc122fa51
SHA512

cee8995906d0d65c44ed21235885d65039ca111be99f70942366e7674ee43fc00a2d199d5833313bac0c1675ee72016e1767ac80f2fb5a281831ccbb3610867a
SSDEEP

393216:xNt0ejYb8TnUAfjz4Nt0ejYb8TnUAfjzk:z4b3G04b3Gk

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2796-0-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2796-1-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2796-25-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2796-40-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2796-44-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2796-42-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2796-38-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2796-36-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2796-34-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2796-45-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2796-32-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2796-30-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2796-29-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2796-23-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2796-21-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2796-19-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2796-17-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2796-15-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2796-13-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2796-11-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2796-9-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2796-7-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2796-5-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2796-3-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2796-2-0x0000000000270000-0x00000000002AE000-memory.dmp	upx
behavioral1/memory/2796-56-0x0000000000270000-0x00000000002AE000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\duokai.dll	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2796	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2796	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe
Token: 33	2796	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe
Token: SeIncBasePriorityPrivilege	2796	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe
Token: 33	2796	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe
Token: SeIncBasePriorityPrivilege	2796	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe
Token: SeDebugPrivilege	2796	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2796	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe
2796	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe
2796	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe
2796	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe
2796	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe

C:\Users\Admin\AppData\Local\Temp\2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe

Filesize
13.8MB

MD5
653cbc8b33539db81e7c60e8ddfe0c8e

SHA1
a1c078ab038bfaf9293ecbf5dbc5d13ccad8f1c3

SHA256
e9e33c893bcce972082aed29d9b3de6a51f7ecbb4649adeef3f257eb2d0e47e7

SHA512
833618b8f11a0cd9532bea1b3d641244cd6885e7f01d1f16adaaf79cb4a599344a45eaf94e30c2251ccd13c0ba6cf9231007d3b005efe28b7ffff2388046f551

Download Submit
memory/2796-21-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2796-57-0x00000000749F0000-0x0000000074A1B000-memory.dmp

Filesize
172KB

Download
memory/2796-23-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2796-44-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2796-42-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2796-38-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2796-36-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2796-34-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2796-45-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2796-32-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2796-30-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2796-29-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2796-40-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2796-25-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2796-5-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2796-17-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2796-15-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2796-13-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2796-11-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2796-9-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2796-7-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2796-19-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2796-3-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2796-2-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2796-1-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2796-56-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2796-0-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing