icedid | a693c322ccdfcae8ca552dcb1179e483b72719c1f3586acb8c09949c1b71c0df

General

Target

intelligence 12.15.20.doc
Size

94KB
MD5

cae7a9d8c05bb9e0f6210680d01ace3b
SHA1

89bf3e579265b7b743f123b51f0995d482ad7587
SHA256

a693c322ccdfcae8ca552dcb1179e483b72719c1f3586acb8c09949c1b71c0df
SHA512

f2072b4c22894f83266f0854941cc9d5af2f3f92f8ef003bc49316567ebbe6dbb2052e95cb5367694faffdf0eac9a337e0214ef1b0e3483f63cd72e3c67787b3

Score

10^/10

icedid banker trojan

Malware Config

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	3680	732	rundll32.exe	WINWORD.EXE

Blocklisted process makes network request 8 IoCs

Processes:

mshta.exerundll32.exe

flow	pid	process
25	4004	mshta.exe
30	3672	rundll32.exe
32	3672	rundll32.exe
34	3672	rundll32.exe
36	3672	rundll32.exe
38	3672	rundll32.exe
43	3672	rundll32.exe
44	3672	rundll32.exe

Downloads MZ/PE file
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3672 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
3672	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

Processes:

rundll32.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings rundll32.exe
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

732 WINWORD.EXE
732 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

3672 rundll32.exe
3672 rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	rundll32.exe

pid	process
3672	rundll32.exe
3672	rundll32.exe

Suspicious use of SetWindowsHookEx 18 IoCs

Processes:

WINWORD.EXE

pid	process
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE
732	WINWORD.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

WINWORD.EXErundll32.exemshta.exe

description	pid	process	target process
PID 732 wrote to memory of 3680	732	WINWORD.EXE	rundll32.exe
PID 732 wrote to memory of 3680	732	WINWORD.EXE	rundll32.exe
PID 3680 wrote to memory of 4004	3680	rundll32.exe	mshta.exe
PID 3680 wrote to memory of 4004	3680	rundll32.exe	mshta.exe
PID 3680 wrote to memory of 4004	3680	rundll32.exe	mshta.exe
PID 4004 wrote to memory of 3672	4004	mshta.exe	rundll32.exe
PID 4004 wrote to memory of 3672	4004	mshta.exe	rundll32.exe
PID 4004 wrote to memory of 3672	4004	mshta.exe	rundll32.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\intelligence 12.15.20.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:732

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" url.dll,OpenURL c:\users\public\index.hta
2⤵
- Process spawned unexpected child process
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3680

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\index.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
3⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:4004

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" c:\programdata\aMvl4.pdf,ShowDialogA -r
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3672

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

3

T1082

Query Registry

2

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\users\public\index.hta
MD5
478ad2476fae05ae109845bc5e8165f8

SHA1
83cdd78c74c5548775c16e187258eccf037ae58e

SHA256
95129bba2c036259fa080060421a1379bbb234cb7161004f27276e861236ddfc

SHA512
05207941b294f08bb295c26e22e8535571967e17d89e3bc6b27d53ddc20cfcb683168ce0a9372f79815e419b83d657aa1112cadd2025b53dae5326de593324f4

Download Submit
\??\c:\programdata\aMvl4.pdf
MD5
e31d54a06ef93c83e854bb34d28317a2

SHA1
cc93a00e87acd314a42e42d33d0b1d4a010f1988

SHA256
65caa5707c4c43941345a86efc8e1ac071d70df984d11ad6554cb8342124c7da

SHA512
474d6ef2f7c8f2ef08ad84db41f8d88dec1fe352349f9d2efaa5cb0518fd3176d46016e76d1e8a8e4b57c2a23dd63bb7b36ca758915bd4cabcf37f7e9c941304

Download Submit
\ProgramData\aMvl4.pdf
MD5
e31d54a06ef93c83e854bb34d28317a2

SHA1
cc93a00e87acd314a42e42d33d0b1d4a010f1988

SHA256
65caa5707c4c43941345a86efc8e1ac071d70df984d11ad6554cb8342124c7da

SHA512
474d6ef2f7c8f2ef08ad84db41f8d88dec1fe352349f9d2efaa5cb0518fd3176d46016e76d1e8a8e4b57c2a23dd63bb7b36ca758915bd4cabcf37f7e9c941304

Download Submit
memory/732-2-0x0000023529A40000-0x000002352A077000-memory.dmp

Filesize
6.2MB

Download
memory/732-3-0x0000023532346000-0x000002353234D000-memory.dmp

Filesize
28KB

Download
memory/732-5-0x0000023531DE3000-0x0000023531E08000-memory.dmp

Filesize
148KB

Download
memory/3672-9-0x0000000000000000-mapping.dmp

Download
memory/3680-6-0x0000000000000000-mapping.dmp

Download
memory/4004-8-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads