04b0da242f78c0ed0b4180437a7976c226987b7893800db7f4a09640a7fc380f

General

Target
2026-08-15_496f967d5e0a873cb7f18bb1e96a43b5_icedid.exe
Size 14.6MB
Sample260815-elnz2aen21
SHA256 04b0da242f78c0ed0b4180437a7976c226987b7893800db7f4a09640a7fc380f
MD5 496f967d5e0a873cb7f18bb1e96a43b5
SHA1 58641fb92458acf2625b5990cb56c3a5ca5ef6f8
SHA512 130ba76699567eb514d69a0c3f58c98f6ac77651778924eaa4f704a8c45ab10e80074165dabbe45fe3477af71db87ccb7a68a2029305b3fc4e3dc757954fddf5
SSDEEP 393216:MXqiiQpDtwIGRlyLiimdEKUXogIONSjWBU9K0x0z:biiQpDtDGbyLpmdEVaON3y9S
TLSH
T102F6238662BC40F8D162D139C8068A4BEBF2F8510B71C7EF11655B6E5F777A20D2A327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/files/0x001200000001c512-5.dat	UPX
behavioral2/memory/1528-8-0x00007FF6859C0000-0x00007FF6861A3000-memory.dmp	UPX
behavioral2/memory/1528-26-0x00007FF6859C0000-0x00007FF6861A3000-memory.dmp	UPX
behavioral2/memory/1528-27-0x00007FF6859C0000-0x00007FF6861A3000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001200000001c512-5.dat	upx
behavioral2/memory/1528-8-0x00007FF6859C0000-0x00007FF6861A3000-memory.dmp	upx
behavioral2/memory/1528-26-0x00007FF6859C0000-0x00007FF6861A3000-memory.dmp	upx
behavioral2/memory/1528-27-0x00007FF6859C0000-0x00007FF6861A3000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\HydroVisual Setup Log.txt	irsetup.exe

Executes dropped EXE 1 IoCs

pid	Process
1528	irsetup.exe

Loads dropped DLL 1 IoCs

pid	Process
1528	irsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	irsetup.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1528	irsetup.exe
1528	irsetup.exe
1528	irsetup.exe
1528	irsetup.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1528	irsetup.exe
1528	irsetup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 1528	3472	2026-08-15_496f967d5e0a873cb7f18bb1e96a43b5_icedid.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-15_496f967d5e0a873cb7f18bb1e96a43b5_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_496f967d5e0a873cb7f18bb1e96a43b5_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:5249474 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\2026-08-15_496f967d5e0a873cb7f18bb1e96a43b5_icedid.exe" "__IRCT:1" "__IRTSS:0" "__IRSID:S-1-5-21-1738198120-2966725515-3980530802-1000"
  2⤵
  - Drops file in Windows directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IRIMG1.BMP

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.BMP
Size 93KB
SHA256 1d757d1fbb87aca104a1746bab31803e8acbf67c528e5f4df91a281522bc851e
MD5 29d37b03cdb269bbb7e82abb0562d26d
SHA1 9bce027766facba494749e6786ec1634320dcc9d
SHA512 24b31ce1f330297a740372e9b1310c64fc97fdba05e5e8e512c8428584e7251dab1b5bee75dcda97d3f6156fe6774b1775a60693d64e18cd2864ace064faa31e
SSDEEP 384:VvXRH/5yGOXG7P/AoyrOBoav+z/SzjPI9d/:VvXRH/5yGOXG7P/AoyrOBoav+z/SvPo/
TLSH
T1D993E45134A1C2CFE65A49F8EF8CE5E8D2DD7E4ACAB0881774757F4F9EB30A11165102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Icon.ico

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Icon.ico
Size 28KB
SHA256 743a1dbcea0d3025819420d61d7e400fa57070b238ed345d6e57d40c50a797f6
MD5 7b4db8e208304c43122e8ec4aea6045c
SHA1 44951b8fb5313187bf00c1e815f2803768cb59b0
SHA512 9fa3bd0dd875d067f0cc440c97ea59b1a3307b50f06b34dd86e8740fbfe7716911d5da5271c40ae9d69e0ef8f5ff798c874f3f2220eb3a47e752ed2b3ce4903b
SSDEEP 384:KXGD5Pw8eRgwnvzF0v2SdtAuy9R66U0gF2cz96QbtwuVbnuAa0tiv9Nxdvuy:hGRgwvy8u88NTF2cz96WmmnuAa0SNPx
TLSH
T1AAD23920E84A8987F49737B808550A3533715FD781DCFBAAF439AC0517ACA9B8072F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

irsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Size 2.4MB
SHA256 42c367fee511322223597b67528145855d193af20d98c6fa96d6e3b75b19bafa
MD5 cd72ec9c0d76a0965c6719e414b6e8b9
SHA1 d3b870577e0477b7d13fd1f27d8ed70492d0eaf2
SHA512 c66bf6423c437306a694d23f88eac43467928e623f404dbce0223ea01842b5fa2ee93064367981651b941e30431a2764b7a0f99bfc4eacf54876dcd283353faa
SSDEEP 49152:pw23RuN6UoaEaZS9HUIQfcV34SOggjnNGaSBtoAORuX2sTxIzz25xRT8M:i6UoarZgHUIF4hggjNUBtoA/G4G3+Q
TLSH
T11DC533C4C235BDAFC578AC738147DB83CD0C7E624AAB966F0798394D99757232603A72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua5.3.dll

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.3.dll
Size 479KB
SHA256 bb374f55613866ffcf354f17fd69000d84f895b884854a5cfb86d41fd08df02b
MD5 743c633c1516fb2b9b5d2769de806ffd
SHA1 36849abab1610a3ef87eae1fdfa3aff7518f7a31
SHA512 318ce1a53637197109490cf4f43edb866c128679f4ab99a6df17719927e1009ee5fe2526f898eab7b73ae5b3020f90d4c7a9adbd51b994009c660bd5e66d94cd
SSDEEP 12288:6i0SNKlgWjeEYNb45F4JybvTctbK9So4V0:6nBgWjeHb45FDbvqOUnV0
TLSH
T1FBA47C5AA26404BAD577E03ACE935557E7F1746803B097EB43B49BB21F23BE2163B301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1528-8-0x00007FF6859C0000-0x00007FF6861A3000-memory.dmp

Download

memory/1528-26-0x00007FF6859C0000-0x00007FF6861A3000-memory.dmp

Download

memory/1528-27-0x00007FF6859C0000-0x00007FF6861A3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads