icedid | 2dd512c4f4c8940207a3eadaf64ae639c0f295239a629466bb1f2d45253a8a93

General

Target

direct-12.20.doc
Size

74KB
MD5

cee51e0e0e0133822c6111ef1ab6cfbb
SHA1

8e6d6ac6416ed49cc20f5e2424dee11222e23994
SHA256

2dd512c4f4c8940207a3eadaf64ae639c0f295239a629466bb1f2d45253a8a93
SHA512

3372d4482ed06f0a617c24eb7978e27195ee40320e1d3fdb9e89dcabe0d8bd95d936d806a61c73e63d512c6e29b34af0283cdad5aeaaa179eafa4b1f371742b6

Score

10^/10

icedid banker trojan

Malware Config

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	3468	732	rundll32.exe	WINWORD.EXE

Blocklisted process makes network request 9 IoCs

Processes:

mshta.exerundll32.exe

flow	pid	process
26	4056	mshta.exe
29	3148	rundll32.exe
31	3148	rundll32.exe
37	3148	rundll32.exe
39	3148	rundll32.exe
41	3148	rundll32.exe
43	3148	rundll32.exe
45	3148	rundll32.exe
47	3148	rundll32.exe

Downloads MZ/PE file
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3148 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
3148	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

Processes:

rundll32.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings rundll32.exe
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

732 WINWORD.EXE
732 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

3148 rundll32.exe
3148 rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	rundll32.exe

pid	process
3148	rundll32.exe
3148	rundll32.exe

Suspicious use of SetWindowsHookEx 17 IoCs

Processes:

WINWORD.EXE

pid	process
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

WINWORD.EXErundll32.exemshta.exe

description	pid	process	target process
PID 732 wrote to memory of 3468	732	WINWORD.EXE	rundll32.exe
PID 732 wrote to memory of 3468	732	WINWORD.EXE	rundll32.exe
PID 3468 wrote to memory of 4056	3468	rundll32.exe	mshta.exe
PID 3468 wrote to memory of 4056	3468	rundll32.exe	mshta.exe
PID 3468 wrote to memory of 4056	3468	rundll32.exe	mshta.exe
PID 4056 wrote to memory of 3148	4056	mshta.exe	rundll32.exe
PID 4056 wrote to memory of 3148	4056	mshta.exe	rundll32.exe
PID 4056 wrote to memory of 3148	4056	mshta.exe	rundll32.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\direct-12.20.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:732

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" url.dll,OpenURL c:\users\public\index.hta
2⤵
- Process spawned unexpected child process
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3468

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\index.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
3⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:4056

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" c:\programdata\aT2QI.pdf,ShowDialogA -r
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3148

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

3

T1082

Query Registry

2

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\users\public\index.hta
MD5
68555a79084fe947402ec3cef78faf32

SHA1
a33f9228b1b216ab9d70df1e5543886108e4416a

SHA256
a71e3fa4a867902bda2bfac324efbeb131c296d65d65e7f70df119e909e49ba0

SHA512
31f1ea0db6c37ca278b67c726c59cc13ef3946a0934df257448a3b2d9e6624244c3416962be442cf69814512077c096f8f613ddceac9b3f8ec70f771a29c8e5c

Download Submit
\??\c:\programdata\aT2QI.pdf
MD5
77c1047a9c5e0a7738fda291aaad5656

SHA1
f0ef43dab625361b866218f9ade60eeba7f8f7de

SHA256
644cbfa0afb9ecdbf94d1e4667fac0f21db2bb25665d68c3a47fbe2570ada89a

SHA512
bf9c19c97190dcc74b078b317704c5993e6e7d916ce036e579e573d56ac7cec7e81a36c87710aeeac433cae90ab90204dd11c07c5a9c96dee8edd4ced2c28b11

Download Submit
\ProgramData\aT2QI.pdf
MD5
77c1047a9c5e0a7738fda291aaad5656

SHA1
f0ef43dab625361b866218f9ade60eeba7f8f7de

SHA256
644cbfa0afb9ecdbf94d1e4667fac0f21db2bb25665d68c3a47fbe2570ada89a

SHA512
bf9c19c97190dcc74b078b317704c5993e6e7d916ce036e579e573d56ac7cec7e81a36c87710aeeac433cae90ab90204dd11c07c5a9c96dee8edd4ced2c28b11

Download Submit
memory/732-2-0x00000235299A0000-0x0000023529FD7000-memory.dmp

Filesize
6.2MB

Download
memory/732-3-0x0000023531F0F000-0x0000023531F13000-memory.dmp

Filesize
16KB

Download
memory/3148-9-0x0000000000000000-mapping.dmp

Download
memory/3468-6-0x0000000000000000-mapping.dmp

Download
memory/4056-8-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads