icedid | ee469f144571531a0b2961a624141b76c6ed18ec2f6d72badb86bd46ad430b44

Analysis

max time kernel
157s
max time network
172s
platform
windows10_x64
resource
win10-en-20210920
submitted
22-10-2021 18:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af8af919173d2af2b99ec479cb6f887b.exe
Size

344KB
MD5

af8af919173d2af2b99ec479cb6f887b
SHA1

8961fbdbbf88256438aea61106f91786ac99a3e7
SHA256

ee469f144571531a0b2961a624141b76c6ed18ec2f6d72badb86bd46ad430b44
SHA512

c78c2741818ca268183cc150d429f5eac5158732a14738381ecdff41240942c9e3f518d606967481130e178b1662c420b6fdbd028344518f148a5ab80f432bba

Score

10^/10

icedid raccoon smokeloader 6655b26b014f56ed3e8df973c407aa18e865e396 1875681804 backdoor banker discovery evasion spyware stealer suricata themida trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://gejajoo7.top/

http://sysaheu9.top/

http://nusurtal4f.net/

http://netomishnetojuk.net/

http://escalivrouter.net/

http://nick22doom4.net/

http://wrioshtivsio.su/

http://nusotiso4.su/

http://rickkhtovkka.biz/

http://palisotoliso.net/

rc4.i32

Extracted

Family

icedid

Campaign

1875681804

enticationmetho.ink

Extracted

Family

raccoon

Botnet

6655b26b014f56ed3e8df973c407aa18e865e396

Attributes

url4cnc
http://telegka.top/kaba4ello
http://telegin.top/kaba4ello
https://t.me/kaba4ello

rc4.plain

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3792 created 876 3792 WerFault.exe FCB9.exe
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Downloads MZ/PE file
Executes dropped EXE 5 IoCs

Processes:

F4E6.exeF71A.exeF99B.exeFCB9.exe3EE.exe

pid process

3684 F4E6.exe
612 F71A.exe
1452 F99B.exe
876 FCB9.exe
1764 3EE.exe

description	pid	process	target process
PID 3792 created 876	3792	WerFault.exe	FCB9.exe

pid	process
3684	F4E6.exe
612	F71A.exe
1452	F99B.exe
876	FCB9.exe
1764	3EE.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

F4E6.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	F4E6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	F4E6.exe

Deletes itself 1 IoCs

Processes:

pid process

2872
Loads dropped DLL 1 IoCs

Processes:

F71A.exe

pid process

612 F71A.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2872

pid	process
612	F71A.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\F4E6.exe	themida
behavioral2/memory/3684-135-0x00000000002F0000-0x00000000002F1000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

F4E6.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA F4E6.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

F4E6.exe

pid process

3684 F4E6.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

af8af919173d2af2b99ec479cb6f887b.exe

description pid process target process

PID 3712 set thread context of 532 3712 af8af919173d2af2b99ec479cb6f887b.exe af8af919173d2af2b99ec479cb6f887b.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3792 876 WerFault.exe FCB9.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	F4E6.exe

pid	process
3684	F4E6.exe

description	pid	process	target process
PID 3712 set thread context of 532	3712	af8af919173d2af2b99ec479cb6f887b.exe	af8af919173d2af2b99ec479cb6f887b.exe

pid	pid_target	process	target process
3792	876	WerFault.exe	FCB9.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

F71A.exeaf8af919173d2af2b99ec479cb6f887b.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	F71A.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	af8af919173d2af2b99ec479cb6f887b.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	af8af919173d2af2b99ec479cb6f887b.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	af8af919173d2af2b99ec479cb6f887b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	F71A.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	F71A.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

af8af919173d2af2b99ec479cb6f887b.exe

pid	process
532	af8af919173d2af2b99ec479cb6f887b.exe
532	af8af919173d2af2b99ec479cb6f887b.exe
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872
2872

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2872
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

af8af919173d2af2b99ec479cb6f887b.exeF71A.exe

pid process

532 af8af919173d2af2b99ec479cb6f887b.exe
612 F71A.exe

pid	process
2872

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

F4E6.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3684	F4E6.exe
Token: SeShutdownPrivilege	2872
Token: SeCreatePagefilePrivilege	2872
Token: SeShutdownPrivilege	2872
Token: SeCreatePagefilePrivilege	2872
Token: SeShutdownPrivilege	2872
Token: SeCreatePagefilePrivilege	2872
Token: SeRestorePrivilege	3792	WerFault.exe
Token: SeBackupPrivilege	3792	WerFault.exe
Token: SeDebugPrivilege	3792	WerFault.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

af8af919173d2af2b99ec479cb6f887b.exe

description	pid	process	target process
PID 3712 wrote to memory of 532	3712	af8af919173d2af2b99ec479cb6f887b.exe	af8af919173d2af2b99ec479cb6f887b.exe
PID 3712 wrote to memory of 532	3712	af8af919173d2af2b99ec479cb6f887b.exe	af8af919173d2af2b99ec479cb6f887b.exe
PID 3712 wrote to memory of 532	3712	af8af919173d2af2b99ec479cb6f887b.exe	af8af919173d2af2b99ec479cb6f887b.exe
PID 3712 wrote to memory of 532	3712	af8af919173d2af2b99ec479cb6f887b.exe	af8af919173d2af2b99ec479cb6f887b.exe
PID 3712 wrote to memory of 532	3712	af8af919173d2af2b99ec479cb6f887b.exe	af8af919173d2af2b99ec479cb6f887b.exe
PID 3712 wrote to memory of 532	3712	af8af919173d2af2b99ec479cb6f887b.exe	af8af919173d2af2b99ec479cb6f887b.exe
PID 2872 wrote to memory of 3684	2872		F4E6.exe
PID 2872 wrote to memory of 3684	2872		F4E6.exe
PID 2872 wrote to memory of 3684	2872		F4E6.exe
PID 2872 wrote to memory of 612	2872		F71A.exe
PID 2872 wrote to memory of 612	2872		F71A.exe
PID 2872 wrote to memory of 612	2872		F71A.exe
PID 2872 wrote to memory of 1452	2872		F99B.exe
PID 2872 wrote to memory of 1452	2872		F99B.exe
PID 2872 wrote to memory of 876	2872		FCB9.exe
PID 2872 wrote to memory of 876	2872		FCB9.exe
PID 2872 wrote to memory of 876	2872		FCB9.exe
PID 2872 wrote to memory of 1764	2872		3EE.exe
PID 2872 wrote to memory of 1764	2872		3EE.exe
PID 2872 wrote to memory of 1764	2872		3EE.exe

C:\Users\Admin\AppData\Local\Temp\af8af919173d2af2b99ec479cb6f887b.exe
"C:\Users\Admin\AppData\Local\Temp\af8af919173d2af2b99ec479cb6f887b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3712

C:\Users\Admin\AppData\Local\Temp\af8af919173d2af2b99ec479cb6f887b.exe
"C:\Users\Admin\AppData\Local\Temp\af8af919173d2af2b99ec479cb6f887b.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:532

C:\Users\Admin\AppData\Local\Temp\F4E6.exe
C:\Users\Admin\AppData\Local\Temp\F4E6.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3684

C:\Users\Admin\AppData\Local\Temp\F71A.exe
C:\Users\Admin\AppData\Local\Temp\F71A.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:612

C:\Users\Admin\AppData\Local\Temp\F99B.exe
C:\Users\Admin\AppData\Local\Temp\F99B.exe
1⤵
- Executes dropped EXE
PID:1452

C:\Users\Admin\AppData\Local\Temp\FCB9.exe
C:\Users\Admin\AppData\Local\Temp\FCB9.exe
1⤵
- Executes dropped EXE
PID:876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 936
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3792

C:\Users\Admin\AppData\Local\Temp\3EE.exe
C:\Users\Admin\AppData\Local\Temp\3EE.exe
1⤵
- Executes dropped EXE
PID:1764

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3EE.exe
MD5
9527bc2fb20d6c1a43cb4c53bd1253d7

SHA1
b67f4071faec387113096ab28e04724c6db79ae9

SHA256
6098630ddf7f5011ede5992ded355949baa00f2c763ea58285bc4552adb7a2f7

SHA512
51e8019c741fc7d88a2da20e60e407895ea1b2efa2c2c623812288057fc8288f2a4379bda1c8a09aff5b88191953a6c27356ef790e09d3228f6280b2d8c95596

Download Submit
C:\Users\Admin\AppData\Local\Temp\3EE.exe
MD5
9527bc2fb20d6c1a43cb4c53bd1253d7

SHA1
b67f4071faec387113096ab28e04724c6db79ae9

SHA256
6098630ddf7f5011ede5992ded355949baa00f2c763ea58285bc4552adb7a2f7

SHA512
51e8019c741fc7d88a2da20e60e407895ea1b2efa2c2c623812288057fc8288f2a4379bda1c8a09aff5b88191953a6c27356ef790e09d3228f6280b2d8c95596

Download Submit
C:\Users\Admin\AppData\Local\Temp\F4E6.exe
MD5
d0c332dd942a7b680063c4eca607f2c4

SHA1
d57b7c95c258c968e7e2f5cd39bf52928cd587fd

SHA256
756f3dc3ceb0db783e3f1cabd10ee6a3af4688147adde714cdea6f226e5f0024

SHA512
70abbdaedfbc7ff4fb06ccd619ad812cb2731e7448d5055a414a609d048fc95067594e2ee74f35284d671b8d618d1914232e20d5cc7d862726a3138c4ec61019

Download Submit
C:\Users\Admin\AppData\Local\Temp\F71A.exe
MD5
560a826cd29ca6598851fd4943de2523

SHA1
e2b9140aeac3c24808b513b17ff68a20581a6aef

SHA256
9821a789596a5923634011cbb4df4dc37d2993e81beaa3b8ffc38279ea3b6c14

SHA512
e6385f9ceb41ac023d3505b810b97579e45a9ea8f8033b7491b26601dad7d33740e82c0df5ef353f330f676529ec6efe9f7be63215d480d4c43a1ef8a7a2b7e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\F71A.exe
MD5
560a826cd29ca6598851fd4943de2523

SHA1
e2b9140aeac3c24808b513b17ff68a20581a6aef

SHA256
9821a789596a5923634011cbb4df4dc37d2993e81beaa3b8ffc38279ea3b6c14

SHA512
e6385f9ceb41ac023d3505b810b97579e45a9ea8f8033b7491b26601dad7d33740e82c0df5ef353f330f676529ec6efe9f7be63215d480d4c43a1ef8a7a2b7e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\F99B.exe
MD5
81fc38de5b6197c4db58eb506037e7cb

SHA1
c2258ab3204e6061d548df202c99aa361242d848

SHA256
2b9cba43290c9d4cc2d6a47432ddac5752c63e5ac519c2056ba466580424ed3b

SHA512
4c96e9104e55454e741a13be34a7c5a3afb8d0d17c1924d629acbd487975d88d4435fd46b34649defe2d047ff4c84e06c4a0d0176085c7b5ab4d80eed18b0d9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\F99B.exe
MD5
81fc38de5b6197c4db58eb506037e7cb

SHA1
c2258ab3204e6061d548df202c99aa361242d848

SHA256
2b9cba43290c9d4cc2d6a47432ddac5752c63e5ac519c2056ba466580424ed3b

SHA512
4c96e9104e55454e741a13be34a7c5a3afb8d0d17c1924d629acbd487975d88d4435fd46b34649defe2d047ff4c84e06c4a0d0176085c7b5ab4d80eed18b0d9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\FCB9.exe
MD5
aa4e082db04b5f44f47f552223e80cac

SHA1
c13cea9a5844ae0efba489c557a1d28e9db33bc7

SHA256
2e60c985939f7ced8d26ccc57e8c43bec2c7f639027e31f7d9a61c726ea7fe09

SHA512
84dea40f9414d9cc4e2ff24fc7fcc2aab942c9636524529198996244e09cc71a85d40939cda997201ded6e1f396a0d7be4369ca402ac88030ae8869008d09f83

Download Submit
C:\Users\Admin\AppData\Local\Temp\FCB9.exe
MD5
aa4e082db04b5f44f47f552223e80cac

SHA1
c13cea9a5844ae0efba489c557a1d28e9db33bc7

SHA256
2e60c985939f7ced8d26ccc57e8c43bec2c7f639027e31f7d9a61c726ea7fe09

SHA512
84dea40f9414d9cc4e2ff24fc7fcc2aab942c9636524529198996244e09cc71a85d40939cda997201ded6e1f396a0d7be4369ca402ac88030ae8869008d09f83

Download Submit
\Users\Admin\AppData\Local\Temp\1105.tmp
MD5
50741b3f2d7debf5d2bed63d88404029

SHA1
56210388a627b926162b36967045be06ffb1aad3

SHA256
f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

SHA512
fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

Download Submit
memory/532-116-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/532-117-0x0000000000402EE8-mapping.dmp

Download
memory/612-127-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/612-129-0x0000000000400000-0x0000000000882000-memory.dmp

Filesize
4.5MB

Download
memory/612-125-0x0000000000A05000-0x0000000000A15000-memory.dmp

Filesize
64KB

Download
memory/612-122-0x0000000000000000-mapping.dmp

Download
memory/876-149-0x0000000000400000-0x00000000008C3000-memory.dmp

Filesize
4.8MB

Download
memory/876-142-0x0000000000000000-mapping.dmp

Download
memory/876-147-0x0000000000DA0000-0x0000000000E2E000-memory.dmp

Filesize
568KB

Download
memory/876-146-0x0000000000BB5000-0x0000000000C04000-memory.dmp

Filesize
316KB

Download
memory/1452-148-0x0000000140000000-0x0000000140009000-memory.dmp

Filesize
36KB

Download
memory/1452-132-0x0000000000000000-mapping.dmp

Download
memory/1764-150-0x0000000000000000-mapping.dmp

Download
memory/2872-153-0x0000000003350000-0x0000000003366000-memory.dmp

Filesize
88KB

Download
memory/2872-119-0x0000000001210000-0x0000000001226000-memory.dmp

Filesize
88KB

Download
memory/3684-138-0x0000000005870000-0x0000000005871000-memory.dmp

Filesize
4KB

Download
memory/3684-141-0x0000000005980000-0x0000000005981000-memory.dmp

Filesize
4KB

Download
memory/3684-126-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/3684-137-0x0000000005FA0000-0x0000000005FA1000-memory.dmp

Filesize
4KB

Download
memory/3684-135-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/3684-120-0x0000000000000000-mapping.dmp

Download
memory/3684-145-0x0000000005910000-0x0000000005911000-memory.dmp

Filesize
4KB

Download
memory/3684-139-0x0000000005AA0000-0x0000000005AA1000-memory.dmp

Filesize
4KB

Download
memory/3684-160-0x0000000007A80000-0x0000000007A81000-memory.dmp

Filesize
4KB

Download
memory/3684-140-0x00000000058D0000-0x00000000058D1000-memory.dmp

Filesize
4KB

Download
memory/3684-154-0x0000000006AB0000-0x0000000006AB1000-memory.dmp

Filesize
4KB

Download
memory/3684-155-0x0000000005C50000-0x0000000005C51000-memory.dmp

Filesize
4KB

Download
memory/3684-156-0x0000000005D70000-0x0000000005D71000-memory.dmp

Filesize
4KB

Download
memory/3684-157-0x0000000005F10000-0x0000000005F11000-memory.dmp

Filesize
4KB

Download
memory/3684-158-0x0000000006880000-0x0000000006881000-memory.dmp

Filesize
4KB

Download
memory/3684-159-0x0000000007380000-0x0000000007381000-memory.dmp

Filesize
4KB

Download
memory/3712-118-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download