b81666b56f42d83df228b537a3d4ded8ccad3f066a9dd37aeb759d0da1455184

General

Target

2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe
Size

43.7MB
MD5

e8c28242f32cec0687c851aa8166f561
SHA1

411c254cb16d4a576bce1cfab2d25cc644789cce
SHA256

b81666b56f42d83df228b537a3d4ded8ccad3f066a9dd37aeb759d0da1455184
SHA512

bdc902e8e7d86364de24daadd0b3f271c58c22df7d4d8a71ef06c6163d03475e501eb5bc2da5765fe6cffd61602598209c3f840248573b79ba694711d85fdc22
SSDEEP

98304:YWoyJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJM:loz

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2844	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
2556	fdlaunchersa.exe
2120	fdlaunchersa.exe

Loads dropped DLL 3 IoCs

pid	Process
2556	fdlaunchersa.exe
2556	fdlaunchersa.exe
2120	fdlaunchersa.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2064 set thread context of 1720	2064	2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe	30
PID 2556 set thread context of 2120	2556	fdlaunchersa.exe	33

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\fdlaunchersa.exe	2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\fdlaunchersa.exe	2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdlaunchersa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdlaunchersa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1720	2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 1720	2064	2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe	30
PID 2064 wrote to memory of 1720	2064	2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe	30
PID 2064 wrote to memory of 1720	2064	2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe	30
PID 2064 wrote to memory of 1720	2064	2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe	30
PID 2064 wrote to memory of 1720	2064	2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe	30
PID 2064 wrote to memory of 1720	2064	2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe	30
PID 2064 wrote to memory of 1720	2064	2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe	30
PID 2064 wrote to memory of 1720	2064	2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe	30
PID 2064 wrote to memory of 1720	2064	2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe	30
PID 2556 wrote to memory of 2120	2556	fdlaunchersa.exe	33
PID 2556 wrote to memory of 2120	2556	fdlaunchersa.exe	33
PID 2556 wrote to memory of 2120	2556	fdlaunchersa.exe	33
PID 2556 wrote to memory of 2120	2556	fdlaunchersa.exe	33
PID 2556 wrote to memory of 2120	2556	fdlaunchersa.exe	33
PID 2556 wrote to memory of 2120	2556	fdlaunchersa.exe	33
PID 2556 wrote to memory of 2120	2556	fdlaunchersa.exe	33
PID 2556 wrote to memory of 2120	2556	fdlaunchersa.exe	33
PID 2556 wrote to memory of 2120	2556	fdlaunchersa.exe	33
PID 1720 wrote to memory of 2844	1720	2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe	34
PID 1720 wrote to memory of 2844	1720	2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe	34
PID 1720 wrote to memory of 2844	1720	2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe	34
PID 1720 wrote to memory of 2844	1720	2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe	34
PID 1720 wrote to memory of 2844	1720	2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe	34
PID 1720 wrote to memory of 2844	1720	2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe	34
PID 1720 wrote to memory of 2844	1720	2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe	34

C:\Users\Admin\AppData\Local\Temp\2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Users\Admin\AppData\Local\Temp\2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\8060.vbs"
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    PID:2844

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\fdlaunchersa.exe
"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\fdlaunchersa.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Program Files (x86)\Microsoft SQL Server Compact Edition\fdlaunchersa.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\8060.vbs

Filesize
500B

MD5
706fa220acb0f46ce34bdc8b9f98bd4a

SHA1
e827257ed820d5cda8994fdba8eba76ed02e2b42

SHA256
c67c22a9c2b53d439a8cb8d20ff97b75b56102bd3e8d0f7dad281be9b12d0175

SHA512
7b8f1f3f2892ae340e5920e34624abb7e48887cdcba9686058324c033bcdf3cacd0b9547ae401d68398f08df752036ffae1966a3396a074da2c71dea161348ae

Download Submit
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\fdlaunchersa.exe

Filesize
43.7MB

MD5
e8c28242f32cec0687c851aa8166f561

SHA1
411c254cb16d4a576bce1cfab2d25cc644789cce

SHA256
b81666b56f42d83df228b537a3d4ded8ccad3f066a9dd37aeb759d0da1455184

SHA512
bdc902e8e7d86364de24daadd0b3f271c58c22df7d4d8a71ef06c6163d03475e501eb5bc2da5765fe6cffd61602598209c3f840248573b79ba694711d85fdc22

Download Submit
memory/1720-9-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1720-6-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1720-10-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1720-11-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1720-0-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1720-8-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1720-4-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1720-32-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1720-2-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2120-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2120-34-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2120-38-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing