icedid | 9f727b8bb2c30ceb1c8d60520588ca81353eb18ef40b0de2f8401b01029781a2

General

Target

input.12.07.2020.doc
Size

74KB
MD5

20e0a37eb586f5c40506955ddd204651
SHA1

1a25ed0ec5c99efce29b06ad3f93ddadd9a49f74
SHA256

9f727b8bb2c30ceb1c8d60520588ca81353eb18ef40b0de2f8401b01029781a2
SHA512

5744cbd6979c2cf30bb0a4bd3c97af30292234e16a37b3ecd4f6a7168f026193ff81e662e626af6bb5e5a11e2a2824f5c8c7bf5178c78c37f949611cbffff4e3

Score

10^/10

icedid banker trojan

Malware Config

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	2216	4764	rundll32.exe	WINWORD.EXE

Blocklisted process makes network request 9 IoCs

Processes:

mshta.exerundll32.exe

flow	pid	process
12	4200	mshta.exe
30	880	rundll32.exe
32	880	rundll32.exe
34	880	rundll32.exe
40	880	rundll32.exe
42	880	rundll32.exe
44	880	rundll32.exe
46	880	rundll32.exe
47	880	rundll32.exe

Downloads MZ/PE file
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

880 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
880	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Modifies registry class 1 IoCs

Processes:

rundll32.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings rundll32.exe
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

4764 WINWORD.EXE
4764 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

880 rundll32.exe
880 rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings	rundll32.exe

pid	process
880	rundll32.exe
880	rundll32.exe

Suspicious use of SetWindowsHookEx 17 IoCs

Processes:

WINWORD.EXE

pid	process
4764	WINWORD.EXE
4764	WINWORD.EXE
4764	WINWORD.EXE
4764	WINWORD.EXE
4764	WINWORD.EXE
4764	WINWORD.EXE
4764	WINWORD.EXE
4764	WINWORD.EXE
4764	WINWORD.EXE
4764	WINWORD.EXE
4764	WINWORD.EXE
4764	WINWORD.EXE
4764	WINWORD.EXE
4764	WINWORD.EXE
4764	WINWORD.EXE
4764	WINWORD.EXE
4764	WINWORD.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

WINWORD.EXErundll32.exemshta.exe

description	pid	process	target process
PID 4764 wrote to memory of 2216	4764	WINWORD.EXE	rundll32.exe
PID 4764 wrote to memory of 2216	4764	WINWORD.EXE	rundll32.exe
PID 2216 wrote to memory of 4200	2216	rundll32.exe	mshta.exe
PID 2216 wrote to memory of 4200	2216	rundll32.exe	mshta.exe
PID 2216 wrote to memory of 4200	2216	rundll32.exe	mshta.exe
PID 4200 wrote to memory of 880	4200	mshta.exe	rundll32.exe
PID 4200 wrote to memory of 880	4200	mshta.exe	rundll32.exe
PID 4200 wrote to memory of 880	4200	mshta.exe	rundll32.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\input.12.07.2020.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" url.dll,OpenURL c:\users\public\index.hta
2⤵
- Process spawned unexpected child process
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2216

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\index.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
3⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:4200

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" c:\programdata\aT2QI.pdf,ShowDialogA -r
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:880

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

3

T1082

Query Registry

2

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\users\public\index.hta
MD5
68555a79084fe947402ec3cef78faf32

SHA1
a33f9228b1b216ab9d70df1e5543886108e4416a

SHA256
a71e3fa4a867902bda2bfac324efbeb131c296d65d65e7f70df119e909e49ba0

SHA512
31f1ea0db6c37ca278b67c726c59cc13ef3946a0934df257448a3b2d9e6624244c3416962be442cf69814512077c096f8f613ddceac9b3f8ec70f771a29c8e5c

Download Submit
\??\c:\programdata\aT2QI.pdf
MD5
77c1047a9c5e0a7738fda291aaad5656

SHA1
f0ef43dab625361b866218f9ade60eeba7f8f7de

SHA256
644cbfa0afb9ecdbf94d1e4667fac0f21db2bb25665d68c3a47fbe2570ada89a

SHA512
bf9c19c97190dcc74b078b317704c5993e6e7d916ce036e579e573d56ac7cec7e81a36c87710aeeac433cae90ab90204dd11c07c5a9c96dee8edd4ced2c28b11

Download Submit
\ProgramData\aT2QI.pdf
MD5
77c1047a9c5e0a7738fda291aaad5656

SHA1
f0ef43dab625361b866218f9ade60eeba7f8f7de

SHA256
644cbfa0afb9ecdbf94d1e4667fac0f21db2bb25665d68c3a47fbe2570ada89a

SHA512
bf9c19c97190dcc74b078b317704c5993e6e7d916ce036e579e573d56ac7cec7e81a36c87710aeeac433cae90ab90204dd11c07c5a9c96dee8edd4ced2c28b11

Download Submit
memory/880-9-0x0000000000000000-mapping.dmp

Download
memory/2216-6-0x0000000000000000-mapping.dmp

Download
memory/4200-8-0x0000000000000000-mapping.dmp

Download
memory/4764-2-0x00007FFAEA500000-0x00007FFAEAB37000-memory.dmp

Filesize
6.2MB

Download
memory/4764-3-0x0000018CBECF5000-0x0000018CBED06000-memory.dmp

Filesize
68KB

Download
memory/4764-4-0x0000018CB1E58000-0x0000018CB1E5D000-memory.dmp

Filesize
20KB

Download
memory/4764-5-0x0000018CBEE07000-0x0000018CBEEC0000-memory.dmp

Filesize
740KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads