Overview

overview

10

Static

static

3

2024-12-17...id.exe

windows7-x64

10

2024-12-17...id.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-12-2024 23:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-17_c961250ad9853c3ee1228b3c6629160e_icedid.exe

  • Size

    3.0MB

  • MD5

    c961250ad9853c3ee1228b3c6629160e

  • SHA1

    1f6203b26a4a577ad274c8ca2d70877927d044df

  • SHA256

    8cdc181cec0f3eaf421c7c801859c8bb629510c56ce643c7c35071c33541b1ee

  • SHA512

    404da73d5d997ac0fdcd332b8ea19be661226d11244d1c801810939b1b8487487dc2bb507899dfe95126355bb5dedac21ff9c7ff8439f5ac852cb25c15e3481c

  • SSDEEP

    98304:FqshbRl6+qOyVq9dPZp72LZcLigmlcHLR6:0sh+POyVq91KZNlgLR6

Score
10/10
salitybackdoordiscoveryevasionlinkpdftrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
    evasion
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • Sality family
    sality
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 6 IoCs
    evasiontrojan
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 2 IoCs
  • HTTP links in PDF interactive object 4 IoCs

    Detects HTTP links in interactive objects within PDF files.

    pdflink
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:784
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:788
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:60
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2700
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:2836
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:2912
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3416
                  • C:\Users\Admin\AppData\Local\Temp\2024-12-17_c961250ad9853c3ee1228b3c6629160e_icedid.exe
                    "C:\Users\Admin\AppData\Local\Temp\2024-12-17_c961250ad9853c3ee1228b3c6629160e_icedid.exe"
                    2⤵
                    • Modifies firewall policy service
                    • UAC bypass
                    • Windows security bypass
                    • Windows security modification
                    • Checks whether UAC is enabled
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:1748
                    • C:\Users\Admin\AppData\Local\Temp\EasyLock\Easy-Lock.exe
                      -l="C:\Users\Admin\AppData\Local\Temp"
                      3⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Enumerates connected drives
                      • System Location Discovery: System Language Discovery
                      • Checks SCSI registry key(s)
                      • Suspicious use of SetWindowsHookEx
                      PID:2164
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                  1⤵
                    PID:3524
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    1⤵
                      PID:3724
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3812
                      • C:\Windows\System32\RuntimeBroker.exe
                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                        1⤵
                          PID:3880
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:3960
                          • C:\Windows\System32\RuntimeBroker.exe
                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                            1⤵
                              PID:3640
                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                              1⤵
                                PID:4092
                              • C:\Windows\System32\RuntimeBroker.exe
                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                1⤵
                                  PID:4836

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Temp\EasyLock\Easy-Lock.exe
                                  Filesize

                                  3.9MB

                                  MD5

                                  f7fd4cbb2618587b85f902fbdddfea30

                                  SHA1

                                  39f5e4097d9d6d91a31180b417a46f71ea6f8b74

                                  SHA256

                                  ee329c9537d91498cac60a4d8d5e93fabe76130ff80b80a33aef3c3d47607f90

                                  SHA512

                                  d206a22cdf9fd6cbf2452c802f1a580e2669864b6226a13dc77465b8ba16a59e583cfe4c8cf21e48cf9431bc999609e4e2c7bceceac63396206132656369f9aa

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\EasyLock\EasyLock_Manual_en.pdf
                                  Filesize

                                  321KB

                                  MD5

                                  fecc2304159e711cfbe4e282b88fa78d

                                  SHA1

                                  acd7cd34b127d1d0915f7862fd217dc140f4f3df

                                  SHA256

                                  daa812fd3daf9afca323333f15a5dd38de0e50ecce196563e10f1013016ca39a

                                  SHA512

                                  6bfeda9bf7c9951d412a9a62164cb2c9f5547ffa5b6c03f09c5f90ce2cb745c12a44c430f87f7ad71ea8c2f917ed61a95f3561a0a535eebeaa7f6b8dde568a06

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\EasyLock\EasyLock_Manual_es.pdf
                                  Filesize

                                  349KB

                                  MD5

                                  814048fb825e018a43f60bddbadb608f

                                  SHA1

                                  b77d94986cd66d5dc49d0195db6f3c96ebed2e2a

                                  SHA256

                                  088c7140a62ffc9ac2337d4ad0e3b4d3faf0b6a0c56edc319120e3bb497c8562

                                  SHA512

                                  fc45898d286c3c1584de4f4b176a8a6434bb464eb8868dee8574913cc2bcc9b3b949b7f46a9f56edc6bf2fc229f16fbd8693271f1a7553b6b830b464b4d52cf8

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\EasyLock\EasyLock_Manual_fr.pdf
                                  Filesize

                                  373KB

                                  MD5

                                  eb5b87342c7dbe57b4b338260454d590

                                  SHA1

                                  f03591ef5da74a4a4c1df9476a503936b4a9d790

                                  SHA256

                                  11599c724881bf14e6d69e0243fb3f09ec44e944c64b1cd74038cf469498c11b

                                  SHA512

                                  7820fcef7b97cd50754beddb8917bfeaa34e828eb86c06d084f15f039cc1fb0839fb72768aa9c98f7acfe1fb7e51b16c1e2c767a282f2128bbbd35e9d3e67b15

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\EasyLock\EasyLock_Manual_pt.pdf
                                  Filesize

                                  387KB

                                  MD5

                                  b1eb678d8188fe4e6da9129b7fd0510c

                                  SHA1

                                  dddcf0167d13e2387f3fd0b8fde9cf389745c39c

                                  SHA256

                                  8381356d3033e081a70031d8e7624d84966742ac9ab57b2e4630d5135302475b

                                  SHA512

                                  9ba7d21c19c04f8122cc9e35e0b62c7925fd62e10c96bf26d99840b79e9a4834b8250efd44307e2069608c718bfb8a1660aff588dfef5cc638fe60a34da60c20

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\EasyLock\LangENG.dll
                                  Filesize

                                  22KB

                                  MD5

                                  a1d39e97dc3dfddcea6e1373d669dea0

                                  SHA1

                                  09c0361e66f6dca5d1a62284e03f3970114b068f

                                  SHA256

                                  017b195d0a660cdd5ba6cc3b40ee5a4274e0e2d75804b266c87a096997c18661

                                  SHA512

                                  1fd71dfdb3398392c6daa6688f2b4902f71907dab834968fa6a305af50ad89877c2d6678907a2d7e31366074f03d610e5601cff05de6d19abe53dc8b1dae4667

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\EasyLock\LangFRA.dll
                                  Filesize

                                  32KB

                                  MD5

                                  4b575251ac253c4c36a3b35589ea2758

                                  SHA1

                                  1c4240c4d4ce22cf79473c8e3600894235803be6

                                  SHA256

                                  3b4331a8a9662258798010895a4db64860a8465095d465e0343cc16945b2b73a

                                  SHA512

                                  560ca2e7bb15406418058ffaeccbac619d6a146d7fc6947b191009dd1ed955a177c4541ad4819e2cb545a0b17fdb2ab89ce66be633e475acee80af8a579ba894

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\EasyLock\LangPOR.dll
                                  Filesize

                                  23KB

                                  MD5

                                  0ac1c4a59687ff0d04c444bb08544071

                                  SHA1

                                  571e3442c70b7ed2dc99d34a8a36f68ec2a9b911

                                  SHA256

                                  9d92dd908aa6d02fdffeced20ce0d2606adbc68944bc0b76e2414b6fabfd6111

                                  SHA512

                                  0e701b2943cdd5e3d2a963c4bead2f04ed2e5bfab1a149910c9face8af945b145e60888d482fd6a1a1d66a9ab08bc7a407e57df8ad311cf3e09b7deeb73bcca4

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\EasyLock\LangSPA.dll
                                  Filesize

                                  23KB

                                  MD5

                                  8fb08f6d1fb732f525ad30ec33216242

                                  SHA1

                                  f58dadf7399ab6d0602c0d6c90f2e3be94f9f68a

                                  SHA256

                                  866cdcaaec7b94bf6dda5059cfb93b8503e4de8554578cf0534babe676516ef4

                                  SHA512

                                  b4066a92632d49d20912c464ca9cf6826350ff2f8810cb50b60750b6bd3fc41b07d6f4c419d4d67d4cf1f26cffb07e7c64db8ef2c9b94f7bb9fcd33c63b0d7aa

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\EasyLock\cryptopp.dll
                                  Filesize

                                  1.2MB

                                  MD5

                                  9a7234078559093e06c9d32148ed95a3

                                  SHA1

                                  40361dad15b9b5ae2757a21d1ce6a61c3c37e891

                                  SHA256

                                  32f5d0a454c26e8aa6f4cad58f3782337cc97cfe2305bbfe564437e5f0d51bbc

                                  SHA512

                                  9a2c3761d799999a691cd605f11c4014f604afa9a46b3b4c9999eef177f0e703ca2ed52c22824cba613559ce37bd134c566d54a4e51141828816b02a4f3da05b

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\EasyLock\dependencies.zip
                                  Filesize

                                  2.5MB

                                  MD5

                                  d7f2330216e740dabd447e350eed7152

                                  SHA1

                                  0ab3ff852c903f3124ca658bc59449007d7b161d

                                  SHA256

                                  f698e40aff3bddfabfe5bf117eac8f8aed6a6a7d8eb435d5d7c49d224ae13a0e

                                  SHA512

                                  02745efdf5a3ca4aa0b0eab7687cabe11c325c5394d0e6da2bf99ac67c84851ad378f2f4ec5ddca2ea878c0fee663298b1ad1271fac9755c1ce91ba50d004d6e

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\EasyLock\dsa_pub
                                  Filesize

                                  884B

                                  MD5

                                  b34301144da892bb84cc83cb2b373e2a

                                  SHA1

                                  234be53b8e4fdd7fb5e3946c0394d24698739754

                                  SHA256

                                  db7249538ef5a7d05f6746b9cb404a1d432f130a9447bbf3135385622979c0e6

                                  SHA512

                                  6a789a1b03ce3ca88b51f93d2bb5679f6450261ffb5d7db2908af6a0974f69459ccffe2aa2ee2f5c5399865974196eda2bd0de68e1bda710ef8b962a8b066fab

                                  Download Submit

                                • memory/1748-9-0x0000000002610000-0x00000000036CA000-memory.dmp

                                  Filesize

                                  16.7MB

                                  Download

                                • memory/1748-5-0x0000000002610000-0x00000000036CA000-memory.dmp

                                  Filesize

                                  16.7MB

                                  Download

                                • memory/1748-15-0x0000000002610000-0x00000000036CA000-memory.dmp

                                  Filesize

                                  16.7MB

                                  Download

                                • memory/1748-69-0x0000000000400000-0x000000000070E000-memory.dmp

                                  Filesize

                                  3.1MB

                                  Download

                                • memory/1748-56-0x00000000024E0000-0x00000000024E2000-memory.dmp

                                  Filesize

                                  8KB

                                  Download

                                • memory/1748-14-0x00000000024F0000-0x00000000024F1000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/1748-13-0x00000000024E0000-0x00000000024E2000-memory.dmp

                                  Filesize

                                  8KB

                                  Download

                                • memory/1748-49-0x0000000002610000-0x00000000036CA000-memory.dmp

                                  Filesize

                                  16.7MB

                                  Download

                                • memory/1748-18-0x00000000024E0000-0x00000000024E2000-memory.dmp

                                  Filesize

                                  8KB

                                  Download

                                • memory/1748-0-0x0000000000400000-0x000000000070E000-memory.dmp

                                  Filesize

                                  3.1MB

                                  Download

                                • memory/1748-17-0x00000000024E0000-0x00000000024E2000-memory.dmp

                                  Filesize

                                  8KB

                                  Download

                                • memory/1748-6-0x0000000002610000-0x00000000036CA000-memory.dmp

                                  Filesize

                                  16.7MB

                                  Download

                                • memory/1748-3-0x0000000002610000-0x00000000036CA000-memory.dmp

                                  Filesize

                                  16.7MB

                                  Download

                                • memory/1748-4-0x0000000002610000-0x00000000036CA000-memory.dmp

                                  Filesize

                                  16.7MB

                                  Download

                                • memory/1748-1-0x0000000002610000-0x00000000036CA000-memory.dmp

                                  Filesize

                                  16.7MB

                                  Download