Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/01/2025, 19:48 UTC
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
General
-
Target
2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe
-
Size
408KB
-
MD5
4b158b27f34592651cf7e687455d9ad6
-
SHA1
be2a0ce6895280b2969564dbb9e27e2a2d3ba9b7
-
SHA256
440bddc4e2106836fc51efe83fa4ef4e8824671475fcf9c0b0ad3ecf35d51647
-
SHA512
90a07897be6feda7396f43e46ce326644cef451aac88de84baa420f75f9757081746c31b1758181a621e21c40bf978983b9766b3ba9c6d76368de4e673e5eb91
-
SSDEEP
6144:HVtTsvH7NWW85J4KWB0Hex0rHnZGXXWg/13WfHofg1ELaeRlMJVBUwQhY6Nx:ji7NWWa4nMJzZhELb6+xR
Malware Config
Extracted
Family
emotet
Botnet
Epoch3
C2
200.109.58.183:443
190.195.148.163:80
46.105.131.68:8080
192.163.221.191:8080
124.150.175.133:80
190.96.118.15:443
216.70.88.55:8080
181.197.2.80:443
110.36.234.146:80
142.93.87.198:8080
23.253.207.142:8080
91.109.5.28:8080
138.197.140.163:8080
201.210.70.8:8080
94.177.253.126:80
75.154.163.1:8090
95.216.212.157:8080
186.84.173.153:80
157.7.164.178:8081
176.58.93.123:80
189.218.243.150:443
189.145.6.189:80
186.109.91.136:80
187.188.166.192:80
162.241.134.130:8080
198.57.217.170:8080
192.241.220.183:8080
190.16.101.10:80
201.196.15.79:990
113.52.135.33:7080
216.75.37.196:8080
190.117.206.153:443
181.198.203.45:443
178.249.187.150:7080
211.229.116.130:80
190.217.1.149:80
5.189.148.98:8080
172.104.70.207:8080
42.190.4.92:443
201.208.244.123:443
154.120.227.206:8080
186.146.110.108:8080
83.169.33.157:8080
139.162.185.116:443
60.52.64.122:80
185.45.24.254:7080
186.18.224.149:80
96.20.84.254:7080
200.55.168.82:20
186.159.246.121:80
85.104.121.33:8443
138.186.179.235:8080
143.95.101.72:8080
95.216.207.86:7080
187.143.219.242:8080
124.150.175.129:8080
181.47.235.26:993
70.45.30.28:80
203.99.188.11:443
181.36.42.205:443
144.76.62.10:8080
212.112.113.235:80
190.55.39.215:80
152.170.220.95:80
51.38.134.203:8080
rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAM426uN11n2LZDk/JiS93WIWG7fGCQmP
3
4h5yIJUxJwrjwtGVexCelD2WKrDw9sa/xKwmQKk3b2fUhwnHXjoSpR7pLaDo7pEc
4
iJB5y6hjbPyrSfL3Fxu74M2SAS0Arj3uAQIDAQAB
5
-----END PUBLIC KEY-----
Signatures
-
Emotet family
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat pollerhand.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pollerhand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pollerhand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe -
Modifies data under HKEY_USERS 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" pollerhand.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0076000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 pollerhand.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{477742CD-4F41-4F7D-AC87-2D5C73CFF7CD}\WpadDecision = "0" pollerhand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad pollerhand.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{477742CD-4F41-4F7D-AC87-2D5C73CFF7CD}\WpadNetworkName = "Network 3" pollerhand.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Local AppWizard-Generated Applications pollerhand.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Local AppWizard-Generated Applications\spiro pollerhand.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings pollerhand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections pollerhand.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Local AppWizard-Generated Applications pollerhand.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Local AppWizard-Generated Applications\spiro\Settings pollerhand.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-51-29-1f-e9-c8 pollerhand.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Local AppWizard-Generated Applications\spiro pollerhand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings pollerhand.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{477742CD-4F41-4F7D-AC87-2D5C73CFF7CD}\WpadDecisionTime = c04ef3122b65db01 pollerhand.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{477742CD-4F41-4F7D-AC87-2D5C73CFF7CD}\de-51-29-1f-e9-c8 pollerhand.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-51-29-1f-e9-c8\WpadDecisionReason = "1" pollerhand.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-51-29-1f-e9-c8\WpadDecisionTime = c04ef3122b65db01 pollerhand.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Local AppWizard-Generated Applications\spiro\Settings pollerhand.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" pollerhand.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{477742CD-4F41-4F7D-AC87-2D5C73CFF7CD} pollerhand.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{477742CD-4F41-4F7D-AC87-2D5C73CFF7CD}\WpadDecisionReason = "1" pollerhand.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Local AppWizard-Generated Applications\spiro\Recent File List pollerhand.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix pollerhand.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" pollerhand.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 pollerhand.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Local AppWizard-Generated Applications\spiro\Recent File List pollerhand.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 pollerhand.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-51-29-1f-e9-c8\WpadDecision = "0" pollerhand.exe -
Modifies registry class 48 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\open\command 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\open 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.spi\ = "Spiro.Document" 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\open\command\ = "C:\\Windows\\SysWOW64\\POLLER~1.EXE \"%1\"" pollerhand.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\open\command pollerhand.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\DefaultIcon 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2025-0~1.EXE,1" 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\ = "Spiro Document" pollerhand.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\open\command pollerhand.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\print\command\ = "C:\\Windows\\SysWOW64\\POLLER~1.EXE /p \"%1\"" pollerhand.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\ = "Spiro Document" pollerhand.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\open\command\ = "C:\\Windows\\SysWOW64\\POLLER~1.EXE \"%1\"" pollerhand.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\printto 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.spi\ShellNew\NullFile 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2025-0~1.EXE /pt \"%1\" \"%2\" \"%3\" \"%4\"" 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\ = "Spiro Document" 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\printto\command 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\DefaultIcon 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2025-0~1.EXE \"%1\"" 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\printto\command\ = "C:\\Windows\\SysWOW64\\POLLER~1.EXE /pt \"%1\" \"%2\" \"%3\" \"%4\"" pollerhand.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.spi\ShellNew 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\open\command 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2025-0~1.EXE /pt \"%1\" \"%2\" \"%3\" \"%4\"" 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document pollerhand.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\printto\command pollerhand.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2025-0~1.EXE /p \"%1\"" 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2025-0~1.EXE,1" 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\DefaultIcon\ = "C:\\Windows\\SysWOW64\\POLLER~1.EXE,1" pollerhand.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\printto\command\ = "C:\\Windows\\SysWOW64\\POLLER~1.EXE /pt \"%1\" \"%2\" \"%3\" \"%4\"" pollerhand.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\DefaultIcon pollerhand.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\print\command\ = "C:\\Windows\\SysWOW64\\POLLER~1.EXE /p \"%1\"" pollerhand.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\print 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.spi 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\ = "Spiro Document" 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\print\command 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2025-0~1.EXE /p \"%1\"" 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\printto\command 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document pollerhand.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2025-0~1.EXE \"%1\"" 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\print\command 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\printto\command pollerhand.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\DefaultIcon\ = "C:\\Windows\\SysWOW64\\POLLER~1.EXE,1" pollerhand.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\print\command pollerhand.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\DefaultIcon pollerhand.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spiro.Document\shell\print\command pollerhand.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2836 pollerhand.exe 2836 pollerhand.exe 2836 pollerhand.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2548 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2500 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe 2548 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe 628 pollerhand.exe 2836 pollerhand.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2376 2500 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe 30 PID 2500 wrote to memory of 2376 2500 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe 30 PID 2500 wrote to memory of 2376 2500 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe 30 PID 2500 wrote to memory of 2376 2500 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe 30 PID 2500 wrote to memory of 2548 2500 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe 31 PID 2500 wrote to memory of 2548 2500 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe 31 PID 2500 wrote to memory of 2548 2500 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe 31 PID 2500 wrote to memory of 2548 2500 2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe 31 PID 628 wrote to memory of 2836 628 pollerhand.exe 34 PID 628 wrote to memory of 2836 628 pollerhand.exe 34 PID 628 wrote to memory of 2836 628 pollerhand.exe 34 PID 628 wrote to memory of 2836 628 pollerhand.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2376
-
-
C:\Users\Admin\AppData\Local\Temp\2025-01-12_4b158b27f34592651cf7e687455d9ad6_icedid.exe--c042fbd52⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2548
-
-
C:\Windows\SysWOW64\pollerhand.exe"C:\Windows\SysWOW64\pollerhand.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\pollerhand.exe--c8850e4d2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2836
-
