Analysis

  • max time kernel
    151s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    06-04-2021 06:25

General

  • Target

    hostsvc.dll

  • Size

    63KB

  • MD5

    fcb6cf720c45b554c5f689fa914ffd2c

  • SHA1

    4d247be7e4c3ee51c026c49dc4b9f59479e8ca77

  • SHA256

    ca93e1c7dc98ca126438c4772f9c3377de5f628b612fe3dc8f72709d5e5bbdb0

  • SHA512

    a27fb5b32662f0624be8b96aaab8e8b09933dee0c996009970d8f7348d5df2142eb23f9215c35c95640a767399dce4636122dc81e58b5cc15ff3ffa3a6a86514

Malware Config

Extracted

Family

icedid

Campaign

2608516171

C2

234willkids.uno

Extracted

Family

icedid

rsa_pubkey.plain

Extracted

Family

icedid

Botnet

478101429

C2

gabry4saver.website

usser234dopper.space

tasyateles.club

jrburnit.website

Attributes
  • url_path

    /news/

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • IcedID First Stage Loader 1 IoCs
  • Blocklisted process makes network request 6 IoCs
  • Downloads MZ/PE file
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Discovers systems in the same network 1 TTPs 2 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies registry class 2 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\hostsvc.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Windows\system32\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\arrive_x64.tmp",update /i:"SickCash\license.dat"
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1252
      • C:\Windows\system32\cmd.exe
        cmd.exe /c chcp >&2
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:688
        • C:\Windows\system32\chcp.com
          chcp
          4⤵
            PID:1812
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get * /Format:List
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1284
        • C:\Windows\system32\ipconfig.exe
          ipconfig /all
          3⤵
          • Gathers network information
          PID:316
        • C:\Windows\system32\systeminfo.exe
          systeminfo
          3⤵
          • Gathers system information
          PID:1632
        • C:\Windows\system32\net.exe
          net config workstation
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1916
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 config workstation
            4⤵
              PID:1704
          • C:\Windows\system32\nltest.exe
            nltest /domain_trusts
            3⤵
              PID:980
            • C:\Windows\system32\nltest.exe
              nltest /domain_trusts /all_trusts
              3⤵
                PID:948
              • C:\Windows\system32\net.exe
                net view /all /domain
                3⤵
                • Discovers systems in the same network
                PID:1096
              • C:\Windows\system32\net.exe
                net view /all
                3⤵
                • Discovers systems in the same network
                PID:676
              • C:\Windows\system32\net.exe
                net group "Domain Admins" /domain
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1092
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 group "Domain Admins" /domain
                  4⤵
                    PID:1456

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Execution

            Command-Line Interface

            1
            T1059

            Defense Evasion

            Install Root Certificate

            1
            T1130

            Modify Registry

            1
            T1112

            Credential Access

            Credentials in Files

            1
            T1081

            Discovery

            System Information Discovery

            3
            T1082

            Remote System Discovery

            1
            T1018

            Collection

            Data from Local System

            1
            T1005

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
              MD5

              61a03d15cf62612f50b74867090dbe79

              SHA1

              15228f34067b4b107e917bebaf17cc7c3c1280a8

              SHA256

              f9e23dc21553daa34c6eb778cd262831e466ce794f4bea48150e8d70d3e6af6d

              SHA512

              5fece89ccbbf994e4f1e3ef89a502f25a72f359d445c034682758d26f01d9f3aa20a43010b9a87f2687da7ba201476922aa46d4906d442d56eb59b2b881259d3

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              MD5

              caa7f313fec16d48c8dd6cabbd5e2d1b

              SHA1

              01a3e8326994b1020febde2ccd2a99ea6bfa2bd3

              SHA256

              784373c3c001c8fae19b6b931451dff94d20619573ebb59a1c43e9102fd8b627

              SHA512

              fc144167befcd5fb4443d9cd45574970519747fb05376d3656e6034e8bbf72a46e40864b1881c56e6c0faf8e37ae2a7795feb5056f0ba838e2b21f2e8a7361c8

            • C:\Users\Admin\AppData\Local\Temp\arrive_x64.tmp
              MD5

              0733ba71c972c267f6e6b1572cc108a6

              SHA1

              2f595da6c3f768d628c1bbdfbc8de0b5e30315ec

              SHA256

              210d45a44ece1a221277d4bad6dcbf961044e164c52908602a2231e60092e6b1

              SHA512

              922768a03371563f2a62c7ced0ab12447a1810c57dfedeaa68242073acb9e3bfdbf386049b8482466e61a5c858f1764f7646bbbe84947713c10eb472e0d3f2bf

            • C:\Users\Admin\AppData\Roaming\SickCash\license.dat
              MD5

              3c6263a9c4117c78d26fc4380af014f2

              SHA1

              eca410dd57af16227220e08067c1895c258eb92b

              SHA256

              29d2a8344bd725d7a8b43cc77a82b3db57a5226ce792ac4b37e7f73ec468510e

              SHA512

              0969cde0d327b9f4b2be708437aea2a1d7a9ba9482125e143ce25c6a2f07e8ee1fa9b23e12f4e88157305f59209e2a8b3a2b2e7eb143b114e3f0c95ba57a2e1a

            • \??\PIPE\NETLOGON
              MD5

              d41d8cd98f00b204e9800998ecf8427e

              SHA1

              da39a3ee5e6b4b0d3255bfef95601890afd80709

              SHA256

              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

              SHA512

              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

            • \Users\Admin\AppData\Local\Temp\arrive_x64.tmp
              MD5

              0733ba71c972c267f6e6b1572cc108a6

              SHA1

              2f595da6c3f768d628c1bbdfbc8de0b5e30315ec

              SHA256

              210d45a44ece1a221277d4bad6dcbf961044e164c52908602a2231e60092e6b1

              SHA512

              922768a03371563f2a62c7ced0ab12447a1810c57dfedeaa68242073acb9e3bfdbf386049b8482466e61a5c858f1764f7646bbbe84947713c10eb472e0d3f2bf

            • \Users\Admin\AppData\Local\Temp\sqlite64.dll
              MD5

              26d773a69f6fad3200d49a7aaa77752b

              SHA1

              3970ffe8aefe0c30daaec65b85fb103c0fc0f2a7

              SHA256

              fca6b7fe66ad9973f18f407e83b56dacd04197cbd35efc498a342d73d6a113e5

              SHA512

              0041b52514460dda19dd065fc46393f6fbe248a4c62fce28e0819abd952756996b34fdea286eb7814a7c868a12656a065278932760e61e53f7102b0dba324e4f

            • memory/316-15-0x0000000000000000-mapping.dmp
            • memory/548-2-0x000007FEFC2A1000-0x000007FEFC2A3000-memory.dmp
              Filesize

              8KB

            • memory/548-3-0x0000000000130000-0x0000000000137000-memory.dmp
              Filesize

              28KB

            • memory/676-25-0x0000000000000000-mapping.dmp
            • memory/688-12-0x0000000000000000-mapping.dmp
            • memory/948-20-0x0000000000000000-mapping.dmp
            • memory/980-19-0x0000000000000000-mapping.dmp
            • memory/1092-26-0x0000000000000000-mapping.dmp
            • memory/1096-22-0x0000000000000000-mapping.dmp
            • memory/1252-8-0x0000000000410000-0x0000000000468000-memory.dmp
              Filesize

              352KB

            • memory/1252-9-0x0000000000120000-0x0000000000125000-memory.dmp
              Filesize

              20KB

            • memory/1252-4-0x0000000000000000-mapping.dmp
            • memory/1284-14-0x0000000000000000-mapping.dmp
            • memory/1456-27-0x0000000000000000-mapping.dmp
            • memory/1464-24-0x000007FEF70D0000-0x000007FEF734A000-memory.dmp
              Filesize

              2.5MB

            • memory/1632-16-0x0000000000000000-mapping.dmp
            • memory/1704-18-0x0000000000000000-mapping.dmp
            • memory/1812-13-0x0000000000000000-mapping.dmp
            • memory/1916-17-0x0000000000000000-mapping.dmp