icedid | 82e46932e3e513ebee488786cc12a1840ec9c2e83dc907f47c82f3e40ba8053e

Analysis

max time kernel
73s
max time network
133s
platform
windows7_x64
resource
win7v20201028
submitted
31/03/2021, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
document-392664139.xlsm
Size 105KB
Sample210331-t12b2le1bj
SHA256 82e46932e3e513ebee488786cc12a1840ec9c2e83dc907f47c82f3e40ba8053e
MD5 d06d4b278d63f87d193c030396636061
SHA1 0f0363e6bd8c2fa3ff90e78bf83f29bc621f58e3
SHA512 439f478c458470c206fffc89299464d75facbe8eed0b2482c44345ea12017a97113ca055aba41a1b517b6520336d2c8502cbee3b090685eb90e605f74c1f015c
MD5 SHA1 SHA512

Score

10^/10

icedid 3717128962 banker loader trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper
https://metaflip.io/ds/3003.gif
xlm40.dropper
https://partsapp.com.br/ds/3003.gif
xlm40.dropper
https://columbia.aula-web.net/ds/3003.gif
xlm40.dropper
https://tajushariya.com/ds/3003.gif
xlm40.dropper
https://agenbolatermurah.com/ds/3003.gif

Extracted

Family

icedid

Campaign

3717128962

usaaforced.fun

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Process spawned unexpected child process 5 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	680	1088	rundll32.exe	24
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1164	1088	rundll32.exe	24
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	744	1088	rundll32.exe	24
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1760	1088	rundll32.exe	24
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1016	1088	rundll32.exe	24

IcedID First Stage Loader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/1796-22-0x0000000000120000-0x0000000000127000-memory.dmp	IcedidFirstLoader

Blocklisted process makes network request 4 IoCs

flow	pid	Process
33	1796	rundll32.exe
35	1796	rundll32.exe
36	1796	rundll32.exe
38	1796	rundll32.exe

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
1016	rundll32.exe
1796	rundll32.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	rundll32.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1088	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1796	rundll32.exe
1796	rundll32.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
1088	EXCEL.EXE
1088	EXCEL.EXE
1088	EXCEL.EXE
1088	EXCEL.EXE
1088	EXCEL.EXE
1088	EXCEL.EXE
1088	EXCEL.EXE
1088	EXCEL.EXE
1088	EXCEL.EXE
1088	EXCEL.EXE
1088	EXCEL.EXE
1088	EXCEL.EXE
1088	EXCEL.EXE
1088	EXCEL.EXE
1088	EXCEL.EXE

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 680	1088	EXCEL.EXE	31
PID 1088 wrote to memory of 680	1088	EXCEL.EXE	31
PID 1088 wrote to memory of 680	1088	EXCEL.EXE	31
PID 1088 wrote to memory of 680	1088	EXCEL.EXE	31
PID 1088 wrote to memory of 680	1088	EXCEL.EXE	31
PID 1088 wrote to memory of 680	1088	EXCEL.EXE	31
PID 1088 wrote to memory of 680	1088	EXCEL.EXE	31
PID 1088 wrote to memory of 1164	1088	EXCEL.EXE	33
PID 1088 wrote to memory of 1164	1088	EXCEL.EXE	33
PID 1088 wrote to memory of 1164	1088	EXCEL.EXE	33
PID 1088 wrote to memory of 1164	1088	EXCEL.EXE	33
PID 1088 wrote to memory of 1164	1088	EXCEL.EXE	33
PID 1088 wrote to memory of 1164	1088	EXCEL.EXE	33
PID 1088 wrote to memory of 1164	1088	EXCEL.EXE	33
PID 1088 wrote to memory of 744	1088	EXCEL.EXE	34
PID 1088 wrote to memory of 744	1088	EXCEL.EXE	34
PID 1088 wrote to memory of 744	1088	EXCEL.EXE	34
PID 1088 wrote to memory of 744	1088	EXCEL.EXE	34
PID 1088 wrote to memory of 744	1088	EXCEL.EXE	34
PID 1088 wrote to memory of 744	1088	EXCEL.EXE	34
PID 1088 wrote to memory of 744	1088	EXCEL.EXE	34
PID 1088 wrote to memory of 1760	1088	EXCEL.EXE	35
PID 1088 wrote to memory of 1760	1088	EXCEL.EXE	35
PID 1088 wrote to memory of 1760	1088	EXCEL.EXE	35
PID 1088 wrote to memory of 1760	1088	EXCEL.EXE	35
PID 1088 wrote to memory of 1760	1088	EXCEL.EXE	35
PID 1088 wrote to memory of 1760	1088	EXCEL.EXE	35
PID 1088 wrote to memory of 1760	1088	EXCEL.EXE	35
PID 1088 wrote to memory of 1016	1088	EXCEL.EXE	36
PID 1088 wrote to memory of 1016	1088	EXCEL.EXE	36
PID 1088 wrote to memory of 1016	1088	EXCEL.EXE	36
PID 1088 wrote to memory of 1016	1088	EXCEL.EXE	36
PID 1088 wrote to memory of 1016	1088	EXCEL.EXE	36
PID 1088 wrote to memory of 1016	1088	EXCEL.EXE	36
PID 1088 wrote to memory of 1016	1088	EXCEL.EXE	36
PID 1016 wrote to memory of 1796	1016	rundll32.exe	37
PID 1016 wrote to memory of 1796	1016	rundll32.exe	37
PID 1016 wrote to memory of 1796	1016	rundll32.exe	37
PID 1016 wrote to memory of 1796	1016	rundll32.exe	37

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\document-392664139.xlsm
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32 ..\ksjvoefv.skd,DllRegisterServer
  2⤵
  - Process spawned unexpected child process
  PID:680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32 ..\ksjvoefv.skd1,DllRegisterServer
  2⤵
  - Process spawned unexpected child process
  PID:1164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32 ..\ksjvoefv.skd2,DllRegisterServer
  2⤵
  - Process spawned unexpected child process
  PID:744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32 ..\ksjvoefv.skd3,DllRegisterServer
  2⤵
  - Process spawned unexpected child process
  PID:1760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32 ..\ksjvoefv.skd4,DllRegisterServer
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Windows\system32\rundll32.exe
    rundll32 ..\ksjvoefv.skd4,DllRegisterServer
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    PID:1796

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/680-9-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/1088-2-0x000000002F8B1000-0x000000002F8B4000-memory.dmp

Download

memory/1088-5-0x0000000002360000-0x0000000002361000-memory.dmp

Download

memory/1088-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download

memory/1088-3-0x00000000715B1000-0x00000000715B3000-memory.dmp

Download

memory/1144-7-0x000007FEF7900000-0x000007FEF7B7A000-memory.dmp

Download

memory/1796-22-0x0000000000120000-0x0000000000127000-memory.dmp

Download