icedid | d5dc27a7806158fa0a11f649da6ec6a7f63f3befe5067e523887cb503591c546

Analysis

max time kernel
118s
max time network
147s
platform
windows10_x64
resource
win10v20210408
submitted
10-05-2021 07:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

legal paper,05.21.doc
Size

76KB
MD5

98be6ee9f171dde4d2b6dc90896c3fd8
SHA1

96d1149a98dd7ae95909301601f3fccc8e2d33d9
SHA256

d5dc27a7806158fa0a11f649da6ec6a7f63f3befe5067e523887cb503591c546
SHA512

42f8b3fcd980b37d891d3efcc9f854a0d181cd5a6b4ae1b20243f80064cd76558d19804a4a2d56ed1f8bc940ee4e89a4a457a404679958fad8a4cc87ab6dd3fa

Score

10^/10

icedid 1420117246 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

1420117246

zasewartefiko.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	1544	988	rundll32.exe	WINWORD.EXE

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

30 1544 rundll32.exe
34 1544 rundll32.exe
Downloads MZ/PE file
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1544 rundll32.exe

flow	pid	process
30	1544	rundll32.exe
34	1544	rundll32.exe

pid	process
1544	rundll32.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXEWINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXEWINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 3 IoCs

Processes:

WINWORD.EXEWINWORD.EXE

pid process

4024 WINWORD.EXE
4024 WINWORD.EXE
988 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1544 rundll32.exe
1544 rundll32.exe

pid	process
1544	rundll32.exe
1544	rundll32.exe

Suspicious use of SetWindowsHookEx 28 IoCs

Processes:

WINWORD.EXEWINWORD.EXE

pid	process
4024	WINWORD.EXE
4024	WINWORD.EXE
4024	WINWORD.EXE
4024	WINWORD.EXE
4024	WINWORD.EXE
4024	WINWORD.EXE
4024	WINWORD.EXE
4024	WINWORD.EXE
4024	WINWORD.EXE
4024	WINWORD.EXE
4024	WINWORD.EXE
4024	WINWORD.EXE
4024	WINWORD.EXE
4024	WINWORD.EXE
988	WINWORD.EXE
988	WINWORD.EXE
988	WINWORD.EXE
988	WINWORD.EXE
988	WINWORD.EXE
988	WINWORD.EXE
988	WINWORD.EXE
988	WINWORD.EXE
988	WINWORD.EXE
988	WINWORD.EXE
4024	WINWORD.EXE
4024	WINWORD.EXE
4024	WINWORD.EXE
4024	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 988 wrote to memory of 1544	988	WINWORD.EXE	rundll32.exe
PID 988 wrote to memory of 1544	988	WINWORD.EXE	rundll32.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\legal paper,05.21.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4024

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe c:\programdata\globalCopyButton.jpg,PluginInit
2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1544

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868
MD5
534da4914128e9b2d7c399c809c27d68

SHA1
19bc3a19999f80a45a10add87e96f89c1fd13f34

SHA256
09a090f0912fb1c407a46ec7b9dedb721137852840b361b2ace1f3f0a0df4e09

SHA512
7091514391002b075c6274390d532d9d1a35e8a95e52d5967ff92050b1ed333adf4c17248d3af3b565d2de553de62f8dee4f842c08a6073f2fc63574f040905e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868
MD5
a08015b1671be811f32b8744969c7196

SHA1
26555a8b2c19342df18c140509174fccf9ae69fe

SHA256
c7283fdf8525c3a5436a8a0fbbef13a4a2ecbe3dc285c67ef0221ceb04bf3397

SHA512
a6b0b59a453327c3324f0a8c26656ab9f4904345c2162e4896687f49a13c994928c88754c75c016fd996f80519f90fa2c71c269abedfee7ea6e608811977788e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.CampaignStates.json
MD5
f1b59332b953b3c99b3c95a44249c0d2

SHA1
1b16a2ca32bf8481e18ff8b7365229b598908991

SHA256
138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c

SHA512
3c1f99ecc394df3741be875fbe8d95e249d1d9ac220805794a22caf81620d5fdd3cce19260d94c0829b3160b28a2b4042e46b56398e60f72134e49254e9679a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.GovernedChannelStates.json
MD5
c56ff60fbd601e84edd5a0ff1010d584

SHA1
342abb130dabeacde1d8ced806d67a3aef00a749

SHA256
200e8cc8dd12e22c9720be73092eafb620435d4569dbdcdba9404ace2aa4343c

SHA512
acd2054fddb33b55b58b870edd4eb6a3cdd3131dfe6139cb3d27054ac2b2a460694c9be9c2a1da0f85606e95e7f393cf16868b6c654e78a664799bc3418da86e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.Settings.json
MD5
e4e83f8123e9740b8aa3c3dfa77c1c04

SHA1
5281eae96efde7b0e16a1d977f005f0d3bd7aad0

SHA256
6034f27b0823b2a6a76fe296e851939fd05324d0af9d55f249c79af118b0eb31

SHA512
bd6b33fd2bbce4a46991bc0d877695d16f7e60b1959a0defc79b627e569e5c6cac7b4ad4e3e1d8389a08584602a51cf84d44cf247f03beb95f7d307fbba12bb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.SurveyEventActivityStats.json
MD5
6ca4960355e4951c72aa5f6364e459d5

SHA1
2fd90b4ec32804dff7a41b6e63c8b0a40b592113

SHA256
88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3

SHA512
8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.SurveyHistoryStats.json
MD5
6ca4960355e4951c72aa5f6364e459d5

SHA1
2fd90b4ec32804dff7a41b6e63c8b0a40b592113

SHA256
88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3

SHA512
8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db-wal
MD5
e35f3b31f757e38260b66a17140a2831

SHA1
0eb0893c406e17f7337140a19070d24cfce59335

SHA256
0923dd6f3e92d34973f8eab8e0b6e19a4da5f334df02c557cbcb7882366d6d02

SHA512
6ea8cb8fe51f23780196dc16784c65ada8a5c1e6b1293a626f07f57f73454eb8c31a0c9986734de360319cc224ceb83a6f1064171e50325b7c186f8cd27f3bfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db-wal
MD5
e35f3b31f757e38260b66a17140a2831

SHA1
0eb0893c406e17f7337140a19070d24cfce59335

SHA256
0923dd6f3e92d34973f8eab8e0b6e19a4da5f334df02c557cbcb7882366d6d02

SHA512
6ea8cb8fe51f23780196dc16784c65ada8a5c1e6b1293a626f07f57f73454eb8c31a0c9986734de360319cc224ceb83a6f1064171e50325b7c186f8cd27f3bfb

Download Submit
\??\c:\programdata\globalCopyButton.jpg
MD5
7fe1862dfb586f86f053fef1f8f67888

SHA1
a5d70ed34977df599bf361730b45a2a5590d0420

SHA256
54e1c8db031af3af8832fa53db94d0b7ad133de21b5bae1a7d4b6c31b6d5b467

SHA512
e9970775c6856d50636686de695fe9dd5e984ac76dd95930b23e1e4d899279c78d31241a193b212b09230d60b52cd1495382617485d743e661030710ca1e9d57

Download Submit
\ProgramData\globalCopyButton.jpg
MD5
7fe1862dfb586f86f053fef1f8f67888

SHA1
a5d70ed34977df599bf361730b45a2a5590d0420

SHA256
54e1c8db031af3af8832fa53db94d0b7ad133de21b5bae1a7d4b6c31b6d5b467

SHA512
e9970775c6856d50636686de695fe9dd5e984ac76dd95930b23e1e4d899279c78d31241a193b212b09230d60b52cd1495382617485d743e661030710ca1e9d57

Download Submit
memory/1544-184-0x0000013ED86B0000-0x0000013ED870B000-memory.dmp

Filesize
364KB

Download
memory/1544-181-0x0000000000000000-mapping.dmp

Download
memory/4024-114-0x00007FFA892C0000-0x00007FFA892D0000-memory.dmp

Filesize
64KB

Download
memory/4024-179-0x000002BC342F0000-0x000002BC342F4000-memory.dmp

Filesize
16KB

Download
memory/4024-123-0x00007FFAA2A90000-0x00007FFAA4985000-memory.dmp

Filesize
31.0MB

Download
memory/4024-122-0x00007FFAA4990000-0x00007FFAA5A7E000-memory.dmp

Filesize
16.9MB

Download
memory/4024-118-0x00007FFAAA370000-0x00007FFAACE93000-memory.dmp

Filesize
43.1MB

Download
memory/4024-119-0x00007FFA892C0000-0x00007FFA892D0000-memory.dmp

Filesize
64KB

Download
memory/4024-117-0x00007FFA892C0000-0x00007FFA892D0000-memory.dmp

Filesize
64KB

Download
memory/4024-116-0x00007FFA892C0000-0x00007FFA892D0000-memory.dmp

Filesize
64KB

Download
memory/4024-115-0x00007FFA892C0000-0x00007FFA892D0000-memory.dmp

Filesize
64KB

Download