7f12fa435226f4012b6a04af3a4a22031796491cf8bdd92e0db940adc122fa51

General

Target

2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe
Size

13.8MB
MD5

7b15cc96d9b59c40bfc1cb2a409a91bc
SHA1

350dcaa8df80e7c316d02fa8993b7adb1b823065
SHA256

7f12fa435226f4012b6a04af3a4a22031796491cf8bdd92e0db940adc122fa51
SHA512

cee8995906d0d65c44ed21235885d65039ca111be99f70942366e7674ee43fc00a2d199d5833313bac0c1675ee72016e1767ac80f2fb5a281831ccbb3610867a
SSDEEP

393216:xNt0ejYb8TnUAfjz4Nt0ejYb8TnUAfjzk:z4b3G04b3Gk

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3532	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3532-0-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx
behavioral2/memory/3532-13-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx
behavioral2/memory/3532-19-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx
behavioral2/memory/3532-46-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx
behavioral2/memory/3532-42-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx
behavioral2/memory/3532-45-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx
behavioral2/memory/3532-40-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx
behavioral2/memory/3532-38-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx
behavioral2/memory/3532-37-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx
behavioral2/memory/3532-33-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx
behavioral2/memory/3532-31-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx
behavioral2/memory/3532-27-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx
behavioral2/memory/3532-25-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx
behavioral2/memory/3532-23-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx
behavioral2/memory/3532-21-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx
behavioral2/memory/3532-17-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx
behavioral2/memory/3532-15-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx
behavioral2/memory/3532-11-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx
behavioral2/memory/3532-3-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx
behavioral2/memory/3532-2-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx
behavioral2/memory/3532-29-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx
behavioral2/memory/3532-9-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx
behavioral2/memory/3532-7-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx
behavioral2/memory/3532-5-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx
behavioral2/memory/3532-1-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx
behavioral2/memory/3532-57-0x0000000000E30000-0x0000000000E6E000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\duokai.dll	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3532	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3532	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe
Token: 33	3532	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe
Token: SeIncBasePriorityPrivilege	3532	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe
Token: SeDebugPrivilege	3532	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3532	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe
3532	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe
3532	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe
3532	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe
3532	2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe

C:\Users\Admin\AppData\Local\Temp\2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2024-09-01_7b15cc96d9b59c40bfc1cb2a409a91bc_hacktools_icedid.exe

Filesize
13.8MB

MD5
653cbc8b33539db81e7c60e8ddfe0c8e

SHA1
a1c078ab038bfaf9293ecbf5dbc5d13ccad8f1c3

SHA256
e9e33c893bcce972082aed29d9b3de6a51f7ecbb4649adeef3f257eb2d0e47e7

SHA512
833618b8f11a0cd9532bea1b3d641244cd6885e7f01d1f16adaaf79cb4a599344a45eaf94e30c2251ccd13c0ba6cf9231007d3b005efe28b7ffff2388046f551

Download Submit
C:\Windows\duokai.dll

Filesize
155KB

MD5
7e288c629f2df794b9c7ae0dfc61531e

SHA1
1bdac38d968b5172c28f3d92ce2691b568c7f229

SHA256
f5e13c9d2826cf623522a4fa8d36ef271ce458d26d460a4fac373e4d81857d2d

SHA512
58fd8ccd2a885477d1a7bc2b0855b1b403b2fc0c0223ef3682808c3a8091a832c62819c3b2232d3d5ebd3df06971299cf85ee7e5ffccd2c81356b22fa8e4012a

Download Submit
memory/3532-21-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/3532-1-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/3532-42-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/3532-45-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/3532-40-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/3532-38-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/3532-37-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/3532-33-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/3532-31-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/3532-27-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/3532-25-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/3532-23-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/3532-46-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/3532-0-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/3532-29-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/3532-11-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/3532-3-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/3532-2-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/3532-15-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/3532-9-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/3532-7-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/3532-5-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/3532-17-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/3532-19-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/3532-57-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/3532-13-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing