Overview

overview

10

Static

static

10

2024-06-28...id.exe

windows7-x64

9

2024-06-28...id.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-06-28_eb5f40b5d0bea0073442aa814a63b50f_floxif_icedid

  • Size

    3.9MB

  • Sample

    240628-r53zhsvcmh

  • MD5

    eb5f40b5d0bea0073442aa814a63b50f

  • SHA1

    0b8e72d801d7397ca4e250fa03cc1ab3c51a176a

  • SHA256

    e75cc7b7f27f01a8e48b0e9b69a08ba62b703c7edacf3be70d0f1c461688cc8c

  • SHA512

    eecb57290fcb9e9e227859a7fe8fd24d1b31ace414799b1981f191eedf103b56f370abaa8bea55b0c6794a055c03e7f750cab17eede854a390c46fe90413ea5d

  • SSDEEP

    49152:QegiSP2SQ8p6ymw5G5s1CmKvMdcZr0vq1N3t3TcoPbz8717n8Tqe:Qe0Q6IwV120WD1N3t7Pkxb8Tp

Score
10/10
adwarepersistenceprivilege_escalationstealerupx

Malware Config

Targets

    • Target

      2024-06-28_eb5f40b5d0bea0073442aa814a63b50f_floxif_icedid

    • Size

      3.9MB

    • MD5

      eb5f40b5d0bea0073442aa814a63b50f

    • SHA1

      0b8e72d801d7397ca4e250fa03cc1ab3c51a176a

    • SHA256

      e75cc7b7f27f01a8e48b0e9b69a08ba62b703c7edacf3be70d0f1c461688cc8c

    • SHA512

      eecb57290fcb9e9e227859a7fe8fd24d1b31ace414799b1981f191eedf103b56f370abaa8bea55b0c6794a055c03e7f750cab17eede854a390c46fe90413ea5d

    • SSDEEP

      49152:QegiSP2SQ8p6ymw5G5s1CmKvMdcZr0vq1N3t3TcoPbz8717n8Tqe:Qe0Q6IwV120WD1N3t7Pkxb8Tp

    Score
    9/10
    adwarepersistenceprivilege_escalationstealerupx

    • UPX dump on OEP (original entry point)

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

AppInit DLLs

1
T1546.010

Browser Extensions

1
T1176

Privilege Escalation

Event Triggered Execution

1
T1546

AppInit DLLs

1
T1546.010

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks