1e42153407ae1f593b5ad9b9b043f95dfd30f773874fbd0741ad1e5b5af2c490

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 03:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe
Size

907KB
MD5

7c740ef443c7ed33df4b85479ee25408
SHA1

1078462d6e5cbbc91a8c76a613599e7aba88902a
SHA256

1e42153407ae1f593b5ad9b9b043f95dfd30f773874fbd0741ad1e5b5af2c490
SHA512

7cefe2c71013068c5aaeb2ea2a61b6a847acb768244bd585f1fc7ea23ed3e517f19873fbf33fa7408c2443c6389b7e96887c23ee0a72d19379cd6f5e1fe3dba6
SSDEEP

12288:UKBbJ0pcx9iEZS1ixBIaHVCHqn3dBLuRvJTYcdMbGXhgY0Xdpk9pGHNu4B2UqpIm:LN0pcnRmixBgQwrYcdMbGXuXdbI4rYB

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
1684	lsass.exe
2576	smss.exe
2212	smss.exe
1984	smss.exe
2860	smss.exe
2888	2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid .exe
2764	smss.exe
2896	smss.exe

Loads dropped DLL 15 IoCs

pid	Process
2500	2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe
2500	2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe
2500	2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe
2500	2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe
1684	lsass.exe
1684	lsass.exe
1684	lsass.exe
1684	lsass.exe
1684	lsass.exe
1684	lsass.exe
2500	2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe
1684	lsass.exe
1684	lsass.exe
1684	lsass.exe
1684	lsass.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	lsass.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\AUTORUN.INF	lsass.exe
File created	C:\AUTORUN.INF	lsass.exe
File opened for modification	D:\AUTORUN.INF	lsass.exe
File opened for modification	\??\E:\AUTORUN.INF	lsass.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\com\lsass.exe	2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe
File created	C:\Windows\SysWOW64\com\smss.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\com\smss.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\com\smss.exe	2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe
File opened for modification	C:\Windows\SysWOW64\com\lsass.exe	smss.exe
File created	C:\Windows\SysWOW64\com\smss.exe	2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe
File created	C:\Windows\SysWOW64\com\lsass.exe	2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2500	2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe
2500	2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe
1684	lsass.exe
1684	lsass.exe
2576	smss.exe
2212	smss.exe
1984	smss.exe
2860	smss.exe
2764	smss.exe
2896	smss.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 1684	2500	2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe	30
PID 2500 wrote to memory of 1684	2500	2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe	30
PID 2500 wrote to memory of 1684	2500	2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe	30
PID 2500 wrote to memory of 1684	2500	2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe	30
PID 2500 wrote to memory of 2576	2500	2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe	31
PID 2500 wrote to memory of 2576	2500	2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe	31
PID 2500 wrote to memory of 2576	2500	2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe	31
PID 2500 wrote to memory of 2576	2500	2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe	31
PID 1684 wrote to memory of 2212	1684	lsass.exe	32
PID 1684 wrote to memory of 2212	1684	lsass.exe	32
PID 1684 wrote to memory of 2212	1684	lsass.exe	32
PID 1684 wrote to memory of 2212	1684	lsass.exe	32
PID 1684 wrote to memory of 1984	1684	lsass.exe	33
PID 1684 wrote to memory of 1984	1684	lsass.exe	33
PID 1684 wrote to memory of 1984	1684	lsass.exe	33
PID 1684 wrote to memory of 1984	1684	lsass.exe	33
PID 1684 wrote to memory of 2860	1684	lsass.exe	34
PID 1684 wrote to memory of 2860	1684	lsass.exe	34
PID 1684 wrote to memory of 2860	1684	lsass.exe	34
PID 1684 wrote to memory of 2860	1684	lsass.exe	34
PID 2500 wrote to memory of 2888	2500	2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe	35
PID 2500 wrote to memory of 2888	2500	2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe	35
PID 2500 wrote to memory of 2888	2500	2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe	35
PID 2500 wrote to memory of 2888	2500	2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe	35
PID 1684 wrote to memory of 2764	1684	lsass.exe	36
PID 1684 wrote to memory of 2764	1684	lsass.exe	36
PID 1684 wrote to memory of 2764	1684	lsass.exe	36
PID 1684 wrote to memory of 2764	1684	lsass.exe	36
PID 1684 wrote to memory of 2896	1684	lsass.exe	37
PID 1684 wrote to memory of 2896	1684	lsass.exe	37
PID 1684 wrote to memory of 2896	1684	lsass.exe	37
PID 1684 wrote to memory of 2896	1684	lsass.exe	37

C:\Users\Admin\AppData\Local\Temp\2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\com\lsass.exe
  "C:\Windows\system32\com\lsass.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\com\smss.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~.pif
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2212
- - C:\Windows\SysWOW64\com\smss.exe
    C:\Windows\system32\com\lsass.exe|C:\pagefile.pif
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1984
- - C:\Windows\SysWOW64\com\smss.exe
    C:\Windows\system32\com\lsass.exe|D:\pagefile.pif
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2860
- - C:\Windows\SysWOW64\com\smss.exe
    C:\Windows\system32\com\lsass.exe|E:\pagefile.pif
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2764
- - C:\Windows\SysWOW64\com\smss.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~.pif
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2896
- C:\Windows\SysWOW64\com\smss.exe
  C:\Users\Admin\AppData\Local\Temp\2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.~|C:\Users\Admin\AppData\Local\Temp\2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid .exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2576
- C:\Users\Admin\AppData\Local\Temp\2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid .exe
  2⤵
  - Executes dropped EXE
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2024-09-29_7c740ef443c7ed33df4b85479ee25408_icedid.~

Filesize
827KB

MD5
4fa488c1ffe6865c07cdc6384c126c7c

SHA1
5e0eb9774411f489ba69a48c32526e6a3eccf418

SHA256
be1ea3280b6ed2f312e305632614318130e8b28f7b905e002eea7ac370a5c65b

SHA512
cf3c5344a99110709c882b10b6f5d5231e3410791f536b1326b4e45e4baef82b47f3137ef346a305822a4f5a4daae9e2d918c568b9a31f1a5c088da539ed9d1b

Download Submit
\Windows\SysWOW64\com\lsass.exe

Filesize
40KB

MD5
94f9d9e6d5b42017d190dcb059fcd3ff

SHA1
a045c5a48222d7f644e23c1bf5e25b13fb57b266

SHA256
13d11a7f74689648ef7b5b3d588332cf08778251992def91d09dfc941c2ff558

SHA512
8bcfb0001798e460d7d786f35c112cc7b392dc0c971accc26fec4bed6f78679d30537533f09e15a7660b3ca5a85e014d2c14f288d6d38dd2d3addd0b78fe9ac6

Download Submit
\Windows\SysWOW64\com\smss.exe

Filesize
5KB

MD5
f2dd64a520abbc1131b52009514ad014

SHA1
316a2cd3cdd3e60b6d655bf0e18d8334b84d09b6

SHA256
103093a6b5fe09d87d9a0e8575863dbca9933a24cb744a5c392e1b03a4f7ebf5

SHA512
2affba32899644ff700ed2cfc1a30301abe16aca31f96e4a7fc02d921f59ebe9a1c613a9b5b2b8a0439bf3b1e795f69c5b044501de2333a6dec4470edef85a14

Download Submit
memory/1984-38-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2212-37-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2576-39-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2860-51-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2896-63-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads