2024-09-01_b3f3a67b9ec6c0ef1035b44156f55b85_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-09-01_b3f3a67b9ec6c0ef1035b44156f55b85_icedid
Size

592KB
MD5

b3f3a67b9ec6c0ef1035b44156f55b85
SHA1

e103c8ae70f8ea8bce9457e28a51e4f0a714eb69
SHA256

e13803a5cd88291330612569e560b24a4b1b8adc9d3f7409541ed94540dc3aa6
SHA512

174045ca6a6d50e2a49aa119f5bdc69f6868b2606202d882849ec60464dd38957facd4372337f75c0f49e38190332e36182f06b8ea8b2382b7f97e478f3980ef
SSDEEP

12288:72PeanEmPO331ia5M1SEk1v0chjIdNqcCpAMV:72PElniy7hjoeC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-09-01_b3f3a67b9ec6c0ef1035b44156f55b85_icedid

Files

2024-09-01_b3f3a67b9ec6c0ef1035b44156f55b85_icedid
.exe windows:4 windows x86 arch:x86

4f13b3b5151d7e9bd8315af10840296d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\zhangdw\InstallDriverOEM\trunk\bin\release-z5\MonServiceUDisk.pdb

Imports

setupapi

CM_Get_Device_ID_List_SizeA
CM_Get_Device_ID_ListA
SetupDiGetDeviceInstanceIdA
CM_Get_Device_IDA
SetupDiOpenDeviceInfoA
SetupDiGetDeviceRegistryPropertyA
SetupDiSetClassInstallParamsW
SetupDiCallClassInstaller
SetupDiGetDeviceInstallParamsW
CM_Request_Device_EjectW
CM_Get_DevNode_Status
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiGetDeviceInstanceIdW
CM_Get_Parent
CM_Get_Device_ID_Size
CM_Get_Device_IDW
SetupDiCreateDeviceInfoList
SetupDiOpenDeviceInfoW
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList

kernel32

GetCurrentThread
GetPrivateProfileIntW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetCurrentDirectoryW
SetErrorMode
MoveFileW
DeleteFileW
GetStringTypeExW
lstrcmpiW
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetVolumeInformationW
GetFullPathNameW
GetShortPathNameW
FileTimeToLocalFileTime
LocalFileTimeToFileTime
SetFileTime
SetFileAttributesW
GetFileAttributesW
GetFileTime
TerminateProcess
ConvertDefaultLocale
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
HeapReAlloc
HeapSize
ExitThread
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
FatalAppExitA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetConsoleCtrlHandler
GetTimeZoneInformation
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
CreateFileA
SetEnvironmentVariableA
EnumResourceLanguagesW
GetLocaleInfoW
CompareStringA
InterlockedExchange
GetModuleHandleA
SuspendThread
ResumeThread
SetThreadPriority
GlobalFlags
SystemTimeToFileTime
FileTimeToSystemTime
GetThreadLocale
lstrlenA
lstrcmpA
GetAtomNameW
GlobalGetAtomNameW
GetVersion
InterlockedIncrement
InterlockedDecrement
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetCurrentProcessId
FreeResource
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
LoadLibraryA
lstrcmpW
GetModuleHandleW
GetVersionExA
GlobalFree
CopyFileW
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
lstrlenW
MulDiv
SetLastError
CreateProcessW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
CreateEventW
WaitForSingleObject
CreateThread
FormatMessageW
LocalFree
SetEvent
WaitForMultipleObjects
FindResourceW
LoadResource
LockResource
SizeofResource
HeapFree
InterlockedCompareExchange
GetProcessHeap
HeapAlloc
GetTickCount
GetModuleFileNameW
FindFirstFileW
FindClose
GetVersionExW
GetProcAddress
FreeLibrary
LoadLibraryW
QueryDosDeviceA
MultiByteToWideChar
WideCharToMultiByte
Sleep
CreateFileW
DeviceIoControl
GetLocalTime
OutputDebugStringW
GetCurrentProcess
GetLastError
CloseHandle
UnhandledExceptionFilter

user32

SetCursor
UnregisterClassW
PostQuitMessage
EndPaint
BeginPaint
GetWindowDC
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
FillRect
SystemParametersInfoW
DestroyMenu
GetMenuItemInfoW
InflateRect
GetMessageW
TranslateMessage
GetActiveWindow
GetCursorPos
ValidateRect
GetDesktopWindow
ClientToScreen
ScrollWindowEx
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
IsDlgButtonChecked
SetDlgItemTextW
SetDlgItemInt
GetDlgItemTextW
GetDlgItemInt
CheckRadioButton
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
LoadCursorW
GetDC
ReleaseDC
GetSysColorBrush
GetWindowThreadProcessId
IsWindowEnabled
RegisterWindowMessageW
LoadIconW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
ShowOwnedPopups
SetWindowsHookExW
CallNextHookEx
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageW
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
GetKeyState
GetScrollRange
SetScrollPos
GetScrollPos
EnableWindow
SetForegroundWindow
ShowScrollBar
UpdateWindow
GetClientRect
GetMenu
MessageBoxW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
GetParent
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
CopyRect
PtInRect
SetWindowPlacement
DeleteMenu
CharUpperW
DestroyIcon
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamW
GetDialogBaseUnits
GetCapture
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetWindowLongW
SetWindowLongW
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetWindow
GetMenuState
GetMenuStringW
AppendMenuW
GetMenuItemID
InsertMenuW
GetMenuItemCount
GetSubMenu
RemoveMenu
EnumChildWindows
IsWindowVisible
GetClassNameW
SendMessageW
FindWindowW
EnumWindows
PostMessageW
IsWindow
UnregisterDeviceNotification
RegisterDeviceNotificationW
SetScrollRange
UnregisterClassA

gdi32

GetObjectType
EnumMetaFile
PlayMetaFile
CreatePen
ExtCreatePen
CreateSolidBrush
CreateHatchBrush
CreateRectRgnIndirect
SetRectRgn
CombineRgn
PlayMetaFileRecord
PatBlt
DPtoLP
GetTextMetricsW
PolyBezierTo
PolylineTo
PolyDraw
ArcTo
GetCurrentPositionEx
SelectPalette
GetStockObject
CreatePatternBrush
CreateDIBPatternBrushPt
DeleteDC
ScaleWindowExtEx
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
GetTextExtentPoint32W
ExtTextOutW
BitBlt
CreateCompatibleDC
CreateFontIndirectW
DeleteObject
CreateBitmap
GetObjectW
SetBkColor
SetTextColor
GetDeviceCaps
CopyMetaFileW
CreateDCW
GetDCOrgEx
GetMapMode
GetClipBox
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutW
RectVisible
PtVisible
StartDocW
GetPixel
GetWindowExtEx
GetViewportExtEx
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
SetMapMode
ExtSelectClipRgn

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyW
RegSetValueW
CreateProcessAsUserW
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
DeleteService
CreateServiceW
StartServiceW
ChangeServiceConfigW
OpenSCManagerW
EnumDependentServicesW
OpenServiceW
ControlService
QueryServiceStatusEx
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCreateKeyW

shell32

ExtractIconW
SHGetFileInfoW

shlwapi

PathFindExtensionW
PathRemoveExtensionW
PathFindFileNameW
PathStripToRootW
PathIsUNCW

ole32

StringFromCLSID
CoTaskMemAlloc
ReleaseStgMedium
CreateBindCtx
ReadClassStg
CoTreatAsClass
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
OleDuplicateData
CoDisconnectObject
CoCreateInstance
StringFromGUID2
CLSIDFromString
ReadFmtUserTypeStg

oleaut32

VarBstrFromDate
VarDecFromStr
VarBstrFromDec
VarBstrFromCy
SafeArrayGetDim
VarCyFromStr
SysReAllocStringLen
VarDateFromStr
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayCopy
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
SafeArrayRedim
SysStringLen
SysFreeString
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
VariantClear
VariantChangeType
VariantInit
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayCreate

Sections

.text
Size: 460KB - Virtual size: 460KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4f13b3b5151d7e9bd8315af10840296d

Headers

File Characteristics

PDB Paths

Imports

setupapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

Sections

.text Size: 460KB - Virtual size: 460KB

.rdata Size: 84KB - Virtual size: 83KB

.data Size: 12KB - Virtual size: 27KB

.rsrc Size: 32KB - Virtual size: 32KB

.text
Size: 460KB - Virtual size: 460KB

.rdata
Size: 84KB - Virtual size: 83KB

.data
Size: 12KB - Virtual size: 27KB

.rsrc
Size: 32KB - Virtual size: 32KB