sality | 3634a88f7a6b0e230949c1fb0eb44b87443ddb07d2249f25ece6e769272bf9d9

Analysis

max time kernel
124s
max time network
126s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Size

997KB
MD5

e37618892626119e136d078750cf0b29
SHA1

21745b67e2898529aa2f7b51a963c9503bc952b8
SHA256

3634a88f7a6b0e230949c1fb0eb44b87443ddb07d2249f25ece6e769272bf9d9
SHA512

8f8a8c3b2f1f138b85e7a76967c2381e298d095f933b23b1cba18e19d9b4ecff59169b3646d68642a2e3f1067b6ff617acbff17e96bf5702a1e73eeef5769b48
SSDEEP

12288:Fas44a+GJczba9J8DxzXa8JmG4WjoLg+XV28f7Wy1Z:Fe4arcO8DRtsxWag6jWyz

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2392-3-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-5-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-9-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-10-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-7-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-6-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-11-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-8-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-4-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-32-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-33-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-45-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-46-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-47-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-49-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-50-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-51-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-53-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-55-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-65-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-67-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-69-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-72-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-74-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-75-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-77-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-84-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-86-0x0000000002060000-0x00000000030EE000-memory.dmp	upx
behavioral1/memory/2392-87-0x0000000002060000-0x00000000030EE000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

Enumerates connected drives 3 TTPs 20 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

description	ioc	process
File opened (read-only)	\??\O:	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
File opened (read-only)	\??\V:	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
File opened (read-only)	\??\W:	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
File opened (read-only)	\??\M:	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
File opened (read-only)	\??\I:	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
File opened (read-only)	\??\L:	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
File opened (read-only)	\??\R:	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
File opened (read-only)	\??\S:	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
File opened (read-only)	\??\T:	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
File opened (read-only)	\??\U:	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
File opened (read-only)	\??\E:	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
File opened (read-only)	\??\G:	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
File opened (read-only)	\??\J:	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
File opened (read-only)	\??\K:	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
File opened (read-only)	\??\N:	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
File opened (read-only)	\??\P:	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
File opened (read-only)	\??\Q:	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
File opened (read-only)	\??\X:	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
File opened (read-only)	\??\Y:	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
File opened (read-only)	\??\Z:	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

description	ioc	process
File opened for modification	C:\autorun.inf	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
File opened for modification	F:\autorun.inf	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

Drops file in Program Files directory 5 IoCs

Processes:

2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

Drops file in Windows directory 1 IoCs

Processes:

2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

description ioc process

File opened for modification C:\Windows\SYSTEM.INI 2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main 2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

description	ioc	process
File opened for modification	C:\Windows\SYSTEM.INI	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

pid	process
2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

Processes:

2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

description	pid	process
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
Token: SeDebugPrivilege	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

pid	process
2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

description	pid	process	target process
PID 2392 wrote to memory of 1124	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	taskhost.exe
PID 2392 wrote to memory of 1228	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Dwm.exe
PID 2392 wrote to memory of 1260	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Explorer.EXE
PID 2392 wrote to memory of 2320	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	DllHost.exe
PID 2392 wrote to memory of 1124	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	taskhost.exe
PID 2392 wrote to memory of 1228	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Dwm.exe
PID 2392 wrote to memory of 1260	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Explorer.EXE
PID 2392 wrote to memory of 2320	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	DllHost.exe
PID 2392 wrote to memory of 1124	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	taskhost.exe
PID 2392 wrote to memory of 1228	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Dwm.exe
PID 2392 wrote to memory of 1260	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Explorer.EXE
PID 2392 wrote to memory of 2320	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	DllHost.exe
PID 2392 wrote to memory of 1124	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	taskhost.exe
PID 2392 wrote to memory of 1228	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Dwm.exe
PID 2392 wrote to memory of 1260	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Explorer.EXE
PID 2392 wrote to memory of 2320	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	DllHost.exe
PID 2392 wrote to memory of 1124	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	taskhost.exe
PID 2392 wrote to memory of 1228	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Dwm.exe
PID 2392 wrote to memory of 1260	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Explorer.EXE
PID 2392 wrote to memory of 2320	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	DllHost.exe
PID 2392 wrote to memory of 1124	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	taskhost.exe
PID 2392 wrote to memory of 1228	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Dwm.exe
PID 2392 wrote to memory of 1260	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Explorer.EXE
PID 2392 wrote to memory of 2320	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	DllHost.exe
PID 2392 wrote to memory of 1124	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	taskhost.exe
PID 2392 wrote to memory of 1228	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Dwm.exe
PID 2392 wrote to memory of 1260	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Explorer.EXE
PID 2392 wrote to memory of 2320	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	DllHost.exe
PID 2392 wrote to memory of 1124	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	taskhost.exe
PID 2392 wrote to memory of 1228	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Dwm.exe
PID 2392 wrote to memory of 1260	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Explorer.EXE
PID 2392 wrote to memory of 2320	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	DllHost.exe
PID 2392 wrote to memory of 1124	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	taskhost.exe
PID 2392 wrote to memory of 1228	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Dwm.exe
PID 2392 wrote to memory of 1260	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Explorer.EXE
PID 2392 wrote to memory of 2320	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	DllHost.exe
PID 2392 wrote to memory of 1124	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	taskhost.exe
PID 2392 wrote to memory of 1228	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Dwm.exe
PID 2392 wrote to memory of 1260	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Explorer.EXE
PID 2392 wrote to memory of 2320	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	DllHost.exe
PID 2392 wrote to memory of 1124	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	taskhost.exe
PID 2392 wrote to memory of 1228	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Dwm.exe
PID 2392 wrote to memory of 1260	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Explorer.EXE
PID 2392 wrote to memory of 2320	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	DllHost.exe
PID 2392 wrote to memory of 1124	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	taskhost.exe
PID 2392 wrote to memory of 1228	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Dwm.exe
PID 2392 wrote to memory of 1260	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Explorer.EXE
PID 2392 wrote to memory of 2320	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	DllHost.exe
PID 2392 wrote to memory of 1124	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	taskhost.exe
PID 2392 wrote to memory of 1228	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Dwm.exe
PID 2392 wrote to memory of 1260	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	Explorer.EXE
PID 2392 wrote to memory of 2320	2392	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe	DllHost.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1124

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1228

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1260

C:\Users\Admin\AppData\Local\Temp\2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-30_e37618892626119e136d078750cf0b29_icedid.exe"
2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2392

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2320

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Disable or Modify System Firewall

T1562.004

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Lateral Movement

Replication Through Removable Media

T1091

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

F:\oicca.pif
Filesize
100KB

MD5
84ae39fe44d63494393fe72f258c19f3

SHA1
6c590ecc20aa03011a8344f24f1159d73bfbb639

SHA256
67017a42a57bff4e277df5d9e3d62d6e4ac2e27086b34c5f9439f4bd7c0fe012

SHA512
b66b34e757a1ee10021490583f07c41e67d468f8d8691407483f07e46c358c8df4474e1007871fdc08234a5b7c179624a9a118cab9981d5e81a0c4e109b83d4f

Download Submit
memory/1124-12-0x0000000001F10000-0x0000000001F12000-memory.dmp

Filesize
8KB

Download
memory/2392-45-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-9-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-0-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/2392-46-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-24-0x00000000052A0000-0x00000000052A2000-memory.dmp

Filesize
8KB

Download
memory/2392-21-0x00000000052A0000-0x00000000052A2000-memory.dmp

Filesize
8KB

Download
memory/2392-22-0x0000000005530000-0x0000000005531000-memory.dmp

Filesize
4KB

Download
memory/2392-5-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-10-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-7-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-6-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-11-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-8-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-4-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-32-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-33-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-26-0x00000000052A0000-0x00000000052A2000-memory.dmp

Filesize
8KB

Download
memory/2392-47-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-27-0x0000000005530000-0x0000000005531000-memory.dmp

Filesize
4KB

Download
memory/2392-49-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-50-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-51-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-53-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-55-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-65-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-67-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-69-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-72-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-74-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-75-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-77-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-84-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-86-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-87-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download
memory/2392-106-0x00000000052A0000-0x00000000052A2000-memory.dmp

Filesize
8KB

Download
memory/2392-3-0x0000000002060000-0x00000000030EE000-memory.dmp

Filesize
16.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads