General
- Target 2026-08-10_32aa5cc76a6cd06d6750896ab056c7f0_icedid
- Size 5.5MB
- Sample260811-aa77bacl3z
- SHA256 0519ae7e41fe6e379c1a36b9e031555a408a637c5799d7b5965d8f3101cd8b67
Score
10/10
Malware Config
Targets
-
- Target 2026-08-10_32aa5cc76a6cd06d6750896ab056c7f0_icedid
- Size 5.5MB
- SHA256 0519ae7e41fe6e379c1a36b9e031555a408a637c5799d7b5965d8f3101cd8b67
Score10/10-
UAC bypass
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects Windows executables referencing non-Windows User-Agents
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables calling ClearMyTracksByProcess
-
Detects executables containing commands for clearing Windows Event Logs
-
Detects executables referencing many IR and analysis tools
-
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
-
UPX dump on OEP (original entry point)
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
2Windows Command Shell
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1File Deletion
1Modify Registry
1