Analysis
-
max time kernel
143s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15-12-2024 00:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe
Resource
win7-20240903-en
windows7-x64
24 signatures
150 seconds
General
-
Target
2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe
-
Size
4.7MB
-
MD5
78478e21d3d565bdbad21ea998100989
-
SHA1
1220591d01d37602d4c115fc1aa6595ac9d6c10c
-
SHA256
740c779fb642de8bd9b50dcb1a5669c88d997c8b6eae72f680ae858d06fde292
-
SHA512
a5886bb4cc43b6a1f31b1223178c9a43f160b86bc6dd9916b840103b66fa866c83cb1b43d61071f96abbc1704ac9b5a681d9e5c57020c0a5d2c2997976ca097c
-
SSDEEP
49152:NOSWCbNc7wKlXFJAgYPPhkmS/tajqOwBQ2dP5TROPE46tW5HiD3uZAt:c0csYInifojqNBdP5Ri6A5HiD3qAt
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe -
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\system32\Drivers\scdemu.sys setup64.exe File opened for modification C:\Windows\system32\Drivers\scdemu.sys setup64.exe -
Executes dropped EXE 3 IoCs
pid Process 448 PowerISO8-x64-Full.exe 1776 devcon.exe 2084 setup64.exe -
Loads dropped DLL 19 IoCs
pid Process 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 448 PowerISO8-x64-Full.exe 448 PowerISO8-x64-Full.exe 448 PowerISO8-x64-Full.exe 448 PowerISO8-x64-Full.exe 448 PowerISO8-x64-Full.exe 856 Process not Found 448 PowerISO8-x64-Full.exe 448 PowerISO8-x64-Full.exe 448 PowerISO8-x64-Full.exe 448 PowerISO8-x64-Full.exe 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 448 PowerISO8-x64-Full.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe -
Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\M: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\Y: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\E: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\G: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\K: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\N: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\Q: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\S: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\V: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\H: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\P: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\U: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\I: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\J: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\O: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\R: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\W: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\X: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\Z: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe -
resource yara_rule behavioral1/memory/2356-11-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-5-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-7-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-10-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-8-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-6-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-3-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-1-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-9-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-4-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-35-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-34-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-36-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-38-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-37-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-40-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-41-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-43-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-44-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-47-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-48-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-49-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-67-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-68-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-71-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-80-0x0000000002420000-0x00000000034AE000-memory.dmp upx behavioral1/memory/2356-162-0x0000000002420000-0x00000000034AE000-memory.dmp upx -
Drops file in Program Files directory 60 IoCs
description ioc Process File created C:\Program Files\PowerISO\Lang\Japanese.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\uninstall.exe PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Greek.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Vietnamese.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Romanian.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Russian.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Portuguese(Brazil).ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\danish.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\piso.exe PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Lithuanian.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Korean.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Swedish.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\MACDll.DLL PowerISO8-x64-Full.exe File opened for modification C:\Program Files\PowerISO\PWRISOVM.EXE PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Italian.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\German.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Malay.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\TradChinese.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\czech.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Turkish.ini PowerISO8-x64-Full.exe File opened for modification C:\Program Files\PowerISO\PWRISOSH.DLL PowerISO8-x64-Full.exe File opened for modification C:\Program Files\PowerISO\devcon.exe PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Belarusian.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Armenian.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Serbian(cyrl).ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Slovak.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Finnish.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Dutch.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\SimpChinese.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\7z-x64.dll PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\English.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Slovenian.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Thai.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Azerbaijani.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\unrar64.dll PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Readme.txt PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Hungarian.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Burmese.ini PowerISO8-x64-Full.exe File opened for modification C:\Program Files\PowerISO\PWRISOVM.exe PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Urdu(Pakistan).ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Farsi.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Bosnian.ini PowerISO8-x64-Full.exe File opened for modification C:\Program Files\PowerISO\PowerISO.exe PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Ukrainian.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\french.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Bulgarian.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Norsk.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\croatian.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\kazakh.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Indonesian.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\PowerISO.chm PowerISO8-x64-Full.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File created C:\Program Files\PowerISO\libvorbis.DLL PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\License.txt PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Polish.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Arabic.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Spanish.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\lame_enc.dll PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\libFLAC.DLL PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\setup64.exe PowerISO8-x64-Full.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PowerISO8-x64-Full.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 27 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mdf PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.c2d PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wim PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cue PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.nrg PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ncd PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dmg PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ashdisc PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.b5i PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mds PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.gi PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pdi PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8658416-7CCB-4c1d-A021-AFF0A2EB8004} 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rar PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cif PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lcd PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.p01 PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pxi PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bif PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bin PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bwi PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vcd PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ima PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.img PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.flp PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.fcd PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cdi PowerISO8-x64-Full.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 448 PowerISO8-x64-Full.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
description pid Process Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 2356 wrote to memory of 3012 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 30 PID 2356 wrote to memory of 3012 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 30 PID 2356 wrote to memory of 3012 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 30 PID 2356 wrote to memory of 3012 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 30 PID 2356 wrote to memory of 3012 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 30 PID 2356 wrote to memory of 3012 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 30 PID 2356 wrote to memory of 3012 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 30 PID 2356 wrote to memory of 1116 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 19 PID 2356 wrote to memory of 1180 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 20 PID 2356 wrote to memory of 1256 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 21 PID 2356 wrote to memory of 1328 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 23 PID 2356 wrote to memory of 1116 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 19 PID 2356 wrote to memory of 1180 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 20 PID 2356 wrote to memory of 1256 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 21 PID 2356 wrote to memory of 1328 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 23 PID 2356 wrote to memory of 1116 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 19 PID 2356 wrote to memory of 1180 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 20 PID 2356 wrote to memory of 1256 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 21 PID 2356 wrote to memory of 1328 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 23 PID 2356 wrote to memory of 1116 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 19 PID 2356 wrote to memory of 1180 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 20 PID 2356 wrote to memory of 1256 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 21 PID 2356 wrote to memory of 1328 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 23 PID 2356 wrote to memory of 448 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 33 PID 2356 wrote to memory of 448 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 33 PID 2356 wrote to memory of 448 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 33 PID 2356 wrote to memory of 448 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 33 PID 2356 wrote to memory of 448 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 33 PID 2356 wrote to memory of 448 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 33 PID 2356 wrote to memory of 448 2356 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 33 PID 448 wrote to memory of 996 448 PowerISO8-x64-Full.exe 34 PID 448 wrote to memory of 996 448 PowerISO8-x64-Full.exe 34 PID 448 wrote to memory of 996 448 PowerISO8-x64-Full.exe 34 PID 448 wrote to memory of 996 448 PowerISO8-x64-Full.exe 34 PID 448 wrote to memory of 996 448 PowerISO8-x64-Full.exe 34 PID 448 wrote to memory of 996 448 PowerISO8-x64-Full.exe 34 PID 448 wrote to memory of 996 448 PowerISO8-x64-Full.exe 34 PID 448 wrote to memory of 1776 448 PowerISO8-x64-Full.exe 35 PID 448 wrote to memory of 1776 448 PowerISO8-x64-Full.exe 35 PID 448 wrote to memory of 1776 448 PowerISO8-x64-Full.exe 35 PID 448 wrote to memory of 1776 448 PowerISO8-x64-Full.exe 35 PID 448 wrote to memory of 2084 448 PowerISO8-x64-Full.exe 36 PID 448 wrote to memory of 2084 448 PowerISO8-x64-Full.exe 36 PID 448 wrote to memory of 2084 448 PowerISO8-x64-Full.exe 36 PID 448 wrote to memory of 2084 448 PowerISO8-x64-Full.exe 36 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1180
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2356 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\PWRISOSH.DLL"3⤵
- System Location Discovery: System Language Discovery
PID:3012
-
-
C:\Users\Admin\AppData\Roaming\PowerISO\Upgrade\PowerISO8-x64-Full.exe"C:\Users\Admin\AppData\Roaming\PowerISO\Upgrade\PowerISO8-x64-Full.exe" /sleep=30003⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s /u "C:\Program Files\PowerISO\PWRISOSH.DLL"4⤵
- System Location Discovery: System Language Discovery
PID:996
-
-
C:\Program Files\PowerISO\devcon.exe"C:\Program Files\PowerISO\devcon.exe" remove *scdbusDevice4⤵
- Executes dropped EXE
PID:1776
-
-
C:\Program Files\PowerISO\setup64.exe"C:\Program Files\PowerISO\setup64.exe" cp C:\Users\Admin\AppData\Local\Temp\nst8AE4.tmp "C:\Windows\system32\Drivers\scdemu.sys"4⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:2084
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1328
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD54198afdeb9ace242c575ee572af22e1f
SHA132784594ec69ca459878010401c3931be8e5e15e
SHA256b4d6704aabfcc8b7cb8f4ee58b162dd124e2d0e4dce20ecf13eebd262dd1e76e
SHA512d4288466d9a669c7735dc788f81fd5581876048644c48a58df5e2f8c70d468464d9de2bcbd295cdfe8510fd77a9a3cc26e3de0a1cf985622fec00baefda7f4cc
-
Filesize
135KB
MD592eae8dec1f992db12aa23d9d55f264a
SHA1add6697b8c1c71980e391619e81e0bada05e38ee
SHA256d01a58e0a222e4d301b75ae80150d8cbc17f56b3f6458352d2c7c449be302eee
SHA512443a12a1a49e388725ee347e650297ba5268d655acd08e623ea988cde07ae08ae861620b600fb223358339eeab926fee1c8377386501310c68a3eb9515649441
-
Filesize
561B
MD565a476590bc4133d3286e18784408444
SHA145ee5ef2b96c77ba38d0cf1516476dd966d22515
SHA256636a60efddd903e92cb30b2880bfb0875adde3e61cc79178effe5ac96cbf66d9
SHA51247823120ad11762d43c5b35bc9022d718d442c6d09e2dab5f26a935df883e184a0cb3da6a17217d0545642f74b87ae02ca057b862ab91b8d28066bd21a1a0485
-
Filesize
452KB
MD5ef4503d1bc80d30386acf67e16b57b33
SHA1c1b33b9d04376bd51a283259bee1ea202fca88c4
SHA2563c923258dd7bacfa5875b3373b30b09cb4b109dbd861c06c483f389d821f7df5
SHA512b527831e3733f1d882749a98a0e3a3fb6196011b4802bc7188d7f37e99ea7f4ed1d8ef8a074f9846cebb490f249c642984bc2827ec026fb625fd8d4c83d877d0
-
Filesize
6.6MB
MD575aa9363a1b7382a127dab05d19f0f57
SHA1c8333227ede62384c81ab49a3ab055d5a996f005
SHA256b2cfbd6fbacad517fe41b09458ffed8465dcb9e684d06723aa927e721b16ca9d
SHA5123093cfd338fab7f8df3253fcb709637accf4153de5be02cfa8ac1c86d986aa8599ad5deb2c6f8ff3ba3e7a4cd3d44947549509bfa57699cd5c96a9a5173f6229
-
Filesize
69KB
MD59d199564b65a91a531b23844649459e9
SHA18d84359ced1c51d14e70cb5ed36a6083c8b914cf
SHA2568dc2490d1d650e3ffbf70922b81ae9800ddd29a644e4d7d29e9616e22a7d0f42
SHA512ae522945d3ddcd7c2d99da14ba62d556928b7e6dfcb07114f13481777878a8ffa448170cebbf76da80d9ae45d0e3a509b0f2a7bd702773c1efcaca26496010d1
-
Filesize
20KB
MD588ac971e8ea0927083875d5338a7361c
SHA135b657bbe00ebd0fdbc142c81422e424a122df07
SHA25610bfde037cdc0bb69f2c5b4a262d3935a90a99ee1509d8795b26c4127cc6633a
SHA51200fcce623a8ba58065be87c1a3935240089199d6e4e6017a88b51610bedc81683cccebf471aa7aa65bc7042ad1f6018390a8c78e769c9a099d2b34902a1d1861
-
Filesize
137KB
MD5dba1c8c7cdf52e8ab6fba090226d5c86
SHA16216046da917ca6526741be9c32b5f6603d8a865
SHA256d41e9206cb5b12cfdad6ffa5c85adfe68c8315e96ac05b5d0b52fe44ed7dad11
SHA5124e571614fc44c2ae274236254dbf82085b40b19d7226eaee5e5bade9cf077f6d546b03bf0ca9b963fc576ba742d3b57ee2e7b7911f634f9410fc97044c68fbd8
-
Filesize
25KB
MD56a45ec125830c244261b28fe97fb9f9d
SHA1f30e65fa3a84c9078bf29af4b4d08ec618a8e44f
SHA256fa8b56b52dc7130d924d0060633b5763c032408385a47ec7438d5e1d481d2fe5
SHA5125387439a2a1f235a2ffe934570db8ab200e2688496d2be39d8f6a47dc7fb55e6e30e957b5b2f6d79799581278bd57c03dc81908afa5e9707375a14ec8a34e4e2
-
Filesize
12KB
MD58cf2ac271d7679b1d68eefc1ae0c5618
SHA17cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA2566950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
SHA512ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
-
Filesize
4.9MB
MD524100c426d2f5ecdf6adcf47bf544789
SHA1339ef04a2b9f24356a27753be8ac6ff96f83e7e4
SHA25688234f55746ce00f73fecdca6b9856fd8afeba840de090d8caa4868f80fd7948
SHA51277c68c6f6999c55a16baa744049802c41261691b273a918bae0a2161675b17b6d73b684f717800148370189d51afee4e18004b89be60258e751a4eb4d544e0ec