Analysis
-
max time kernel
101s -
max time network
16s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
06-05-2021 19:02
General
-
Target
dbedb87b_by_Libranalysis.doc
-
Size
79KB
-
MD5
dbedb87ba150b3ceae4ac1036fe3c9bd
-
SHA1
711ebf4c3910d2d91a5a13024aec23a47bde7d97
-
SHA256
26903fb6387161be921360f3803668c1d86a277dee246323bf1e11ed972641b4
-
SHA512
e042d7b3e4249273afac112a0a8d5d9c43d648ab821e9b0031cb15e4487ed92e118c855fd5dba1e45ba9029012ea2d6789f4bb869b3f0b862ca55434c4526574
Malware Config
Extracted
icedid
2941843931
dsedertyhuiokle.top
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 5 IoCs
-
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies Internet Explorer settings 1 TTPs 10 IoCs
-
Modifies registry class 64 IoCs
-
Modifies system certificate store 2 TTPs 4 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\dbedb87b_by_Libranalysis.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer c:\users\public\countViewSelect.hta2⤵
- Process spawned unexpected child process
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Public\countViewSelect.hta"2⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" c:\users\public\countViewSelect.jpg,PluginInit3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" c:\users\public\countViewSelect.jpg,PluginInit4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\countViewSelect.htaMD5
a1f07f22e32902cf1c2493e3886e4ee6
SHA1af0d2e3e25b4c406b6f43585a66b2b2e7a4d527c
SHA2561b61d75451a001135e801d87d846f97819c3bb43419d95bacbe5c5593632ffc2
SHA512afe32dc8f0477df39a0f0327eba321a3a37cc114bb8c4e4a4e689038c2cec438a819b29f33c415acf2166197e70ff43363bf11f17be09dd5c711b3dac4df62d7
-
\??\c:\users\public\countViewSelect.jpgMD5
feafeb25dc7afee271a46f1b794c307a
SHA1671d486fb71c0dd20bd26e42073f37f75e39b0a0
SHA2561ef8d9241d69ab3ad8a03d998a9ee1fcb8dee19f7829dcdebe1351425bec399a
SHA512c813ae037f6653143042e007c40f61bb35f30ec4cf59137d9e1775121c3b62c72fd7dabda2e23cd340fafe2d017e1afe32b5adc2003f6cd059076fbfb19d3e66
-
\Users\Public\countViewSelect.jpgMD5
feafeb25dc7afee271a46f1b794c307a
SHA1671d486fb71c0dd20bd26e42073f37f75e39b0a0
SHA2561ef8d9241d69ab3ad8a03d998a9ee1fcb8dee19f7829dcdebe1351425bec399a
SHA512c813ae037f6653143042e007c40f61bb35f30ec4cf59137d9e1775121c3b62c72fd7dabda2e23cd340fafe2d017e1afe32b5adc2003f6cd059076fbfb19d3e66
-
\Users\Public\countViewSelect.jpgMD5
feafeb25dc7afee271a46f1b794c307a
SHA1671d486fb71c0dd20bd26e42073f37f75e39b0a0
SHA2561ef8d9241d69ab3ad8a03d998a9ee1fcb8dee19f7829dcdebe1351425bec399a
SHA512c813ae037f6653143042e007c40f61bb35f30ec4cf59137d9e1775121c3b62c72fd7dabda2e23cd340fafe2d017e1afe32b5adc2003f6cd059076fbfb19d3e66
-
memory/432-78-0x0000000001B10000-0x0000000001B5D000-memory.dmpFilesize
308KB
-
memory/432-76-0x0000000000000000-mapping.dmp
-
memory/1096-61-0x0000000070851000-0x0000000070853000-memory.dmpFilesize
8KB
-
memory/1096-62-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1096-79-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1096-60-0x0000000072DD1000-0x0000000072DD4000-memory.dmpFilesize
12KB
-
memory/1096-71-0x0000000005E60000-0x0000000006AAA000-memory.dmpFilesize
12.3MB
-
memory/1148-64-0x00000000768B1000-0x00000000768B3000-memory.dmpFilesize
8KB
-
memory/1148-65-0x000000006B841000-0x000000006B843000-memory.dmpFilesize
8KB
-
memory/1148-63-0x0000000000000000-mapping.dmp
-
memory/1328-68-0x0000000000000000-mapping.dmp
-
memory/1360-72-0x0000000000000000-mapping.dmp
-
memory/1640-69-0x0000000000000000-mapping.dmp
-
memory/1768-66-0x000007FEFC221000-0x000007FEFC223000-memory.dmpFilesize
8KB
