icedid | 2031990c23b02f14927d6e81c767671f030228a52f56ffba1dbc5a20d5cd3552

General

Target

2031990c23b02f14927d6e81c767671f030228a52f56f.exe
Size

333KB
MD5

1af134c8d0c42c155d731736acdad0ed
SHA1

6fbdd621b41cad2aeec78697ef480e7ac9e4320d
SHA256

2031990c23b02f14927d6e81c767671f030228a52f56ffba1dbc5a20d5cd3552
SHA512

f0199832b27387951bc00bc19346b94ae8b4a324be4e3fcc4d331fe76904ea5234a91ba5cbd3e4f0d14fb4dd408804d130069dd3aef300ef48c0805cfa57e409

Score

10^/10

icedid smokeloader 1875681804 backdoor banker suricata trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/

rc4.i32

Extracted

Family

icedid

Campaign

1875681804

C2

enticationmetho.ink

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Downloads MZ/PE file
Executes dropped EXE 4 IoCs

Processes:

462D.exe8FAA.exeSmartClock.exejwccfsa

pid process

3364 462D.exe
3500 8FAA.exe
1500 SmartClock.exe
1036 jwccfsa
Deletes itself 1 IoCs

Processes:

pid process

3008
Drops startup file 1 IoCs

Processes:

8FAA.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk 8FAA.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
3364	462D.exe
3500	8FAA.exe
1500	SmartClock.exe
1036	jwccfsa

pid	process
3008

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk	8FAA.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

2031990c23b02f14927d6e81c767671f030228a52f56f.exejwccfsa

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2031990c23b02f14927d6e81c767671f030228a52f56f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jwccfsa
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jwccfsa
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jwccfsa
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2031990c23b02f14927d6e81c767671f030228a52f56f.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2031990c23b02f14927d6e81c767671f030228a52f56f.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

SmartClock.exe

pid process

1500 SmartClock.exe

pid	process
1500	SmartClock.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2031990c23b02f14927d6e81c767671f030228a52f56f.exe

pid	process
3632	2031990c23b02f14927d6e81c767671f030228a52f56f.exe
3632	2031990c23b02f14927d6e81c767671f030228a52f56f.exe
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3008
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

2031990c23b02f14927d6e81c767671f030228a52f56f.exejwccfsa

pid process

3632 2031990c23b02f14927d6e81c767671f030228a52f56f.exe
1036 jwccfsa

pid	process
3008

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

8FAA.exe

description	pid	process	target process
PID 3008 wrote to memory of 3364	3008		462D.exe
PID 3008 wrote to memory of 3364	3008		462D.exe
PID 3008 wrote to memory of 3500	3008		8FAA.exe
PID 3008 wrote to memory of 3500	3008		8FAA.exe
PID 3008 wrote to memory of 3500	3008		8FAA.exe
PID 3500 wrote to memory of 1500	3500	8FAA.exe	SmartClock.exe
PID 3500 wrote to memory of 1500	3500	8FAA.exe	SmartClock.exe
PID 3500 wrote to memory of 1500	3500	8FAA.exe	SmartClock.exe

C:\Users\Admin\AppData\Local\Temp\2031990c23b02f14927d6e81c767671f030228a52f56f.exe
"C:\Users\Admin\AppData\Local\Temp\2031990c23b02f14927d6e81c767671f030228a52f56f.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3632

C:\Users\Admin\AppData\Local\Temp\462D.exe
C:\Users\Admin\AppData\Local\Temp\462D.exe
1⤵
- Executes dropped EXE
PID:3364

C:\Users\Admin\AppData\Local\Temp\8FAA.exe
C:\Users\Admin\AppData\Local\Temp\8FAA.exe
1⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:3500

C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:1500

C:\Users\Admin\AppData\Roaming\jwccfsa
C:\Users\Admin\AppData\Roaming\jwccfsa
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1036

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\462D.exe
MD5
81fc38de5b6197c4db58eb506037e7cb

SHA1
c2258ab3204e6061d548df202c99aa361242d848

SHA256
2b9cba43290c9d4cc2d6a47432ddac5752c63e5ac519c2056ba466580424ed3b

SHA512
4c96e9104e55454e741a13be34a7c5a3afb8d0d17c1924d629acbd487975d88d4435fd46b34649defe2d047ff4c84e06c4a0d0176085c7b5ab4d80eed18b0d9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\462D.exe
MD5
81fc38de5b6197c4db58eb506037e7cb

SHA1
c2258ab3204e6061d548df202c99aa361242d848

SHA256
2b9cba43290c9d4cc2d6a47432ddac5752c63e5ac519c2056ba466580424ed3b

SHA512
4c96e9104e55454e741a13be34a7c5a3afb8d0d17c1924d629acbd487975d88d4435fd46b34649defe2d047ff4c84e06c4a0d0176085c7b5ab4d80eed18b0d9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\8FAA.exe
MD5
89f4a226f68aace5e2582edb8d4a0a18

SHA1
852e4183652f4642f95941f76f3bdd41245dbffc

SHA256
7754f3b20e8e24f8fa2a239e68d5541f2db0310837c941594dadc1e1a266f1f0

SHA512
3dd20d30430ff1a95dba3d17bdef889ac55aea16629cf3f3f796c5a8e18ac4e13c50cc1a014abda4f8ea15f85d4ab6640bc041592c8fe9ed74387018c12b8509

Download Submit
C:\Users\Admin\AppData\Local\Temp\8FAA.exe
MD5
89f4a226f68aace5e2582edb8d4a0a18

SHA1
852e4183652f4642f95941f76f3bdd41245dbffc

SHA256
7754f3b20e8e24f8fa2a239e68d5541f2db0310837c941594dadc1e1a266f1f0

SHA512
3dd20d30430ff1a95dba3d17bdef889ac55aea16629cf3f3f796c5a8e18ac4e13c50cc1a014abda4f8ea15f85d4ab6640bc041592c8fe9ed74387018c12b8509

Download Submit
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
MD5
89f4a226f68aace5e2582edb8d4a0a18

SHA1
852e4183652f4642f95941f76f3bdd41245dbffc

SHA256
7754f3b20e8e24f8fa2a239e68d5541f2db0310837c941594dadc1e1a266f1f0

SHA512
3dd20d30430ff1a95dba3d17bdef889ac55aea16629cf3f3f796c5a8e18ac4e13c50cc1a014abda4f8ea15f85d4ab6640bc041592c8fe9ed74387018c12b8509

Download Submit
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
MD5
89f4a226f68aace5e2582edb8d4a0a18

SHA1
852e4183652f4642f95941f76f3bdd41245dbffc

SHA256
7754f3b20e8e24f8fa2a239e68d5541f2db0310837c941594dadc1e1a266f1f0

SHA512
3dd20d30430ff1a95dba3d17bdef889ac55aea16629cf3f3f796c5a8e18ac4e13c50cc1a014abda4f8ea15f85d4ab6640bc041592c8fe9ed74387018c12b8509

Download Submit
C:\Users\Admin\AppData\Roaming\jwccfsa
MD5
1af134c8d0c42c155d731736acdad0ed

SHA1
6fbdd621b41cad2aeec78697ef480e7ac9e4320d

SHA256
2031990c23b02f14927d6e81c767671f030228a52f56ffba1dbc5a20d5cd3552

SHA512
f0199832b27387951bc00bc19346b94ae8b4a324be4e3fcc4d331fe76904ea5234a91ba5cbd3e4f0d14fb4dd408804d130069dd3aef300ef48c0805cfa57e409

Download Submit
C:\Users\Admin\AppData\Roaming\jwccfsa
MD5
1af134c8d0c42c155d731736acdad0ed

SHA1
6fbdd621b41cad2aeec78697ef480e7ac9e4320d

SHA256
2031990c23b02f14927d6e81c767671f030228a52f56ffba1dbc5a20d5cd3552

SHA512
f0199832b27387951bc00bc19346b94ae8b4a324be4e3fcc4d331fe76904ea5234a91ba5cbd3e4f0d14fb4dd408804d130069dd3aef300ef48c0805cfa57e409

Download Submit
memory/1036-137-0x0000000000400000-0x0000000000882000-memory.dmp

Filesize
4.5MB

Download
memory/1036-136-0x0000000000B76000-0x0000000000B86000-memory.dmp

Filesize
64KB

Download
memory/1500-133-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/1500-127-0x0000000000000000-mapping.dmp

Download
memory/1500-132-0x0000000000C26000-0x0000000000CA6000-memory.dmp

Filesize
512KB

Download
memory/3008-138-0x00000000032A0000-0x00000000032B6000-memory.dmp

Filesize
88KB

Download
memory/3008-118-0x0000000001310000-0x0000000001326000-memory.dmp

Filesize
88KB

Download
memory/3364-122-0x0000000140000000-0x0000000140009000-memory.dmp

Filesize
36KB

Download
memory/3364-119-0x0000000000000000-mapping.dmp

Download
memory/3500-126-0x0000000000A05000-0x0000000000A85000-memory.dmp

Filesize
512KB

Download
memory/3500-130-0x0000000000E50000-0x0000000000EE1000-memory.dmp

Filesize
580KB

Download
memory/3500-131-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/3500-123-0x0000000000000000-mapping.dmp

Download
memory/3632-116-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/3632-117-0x0000000000400000-0x0000000000882000-memory.dmp

Filesize
4.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads