icedid | 815df99c15d3431db3e018aad2827a816d078063fa75da842c30efff6bf08e63

General

Target

documents.lnk
Size

2KB
MD5

c754f3d9cdca9c58f7b9d0a486e4d388
SHA1

078f05b78e7a83ab17d9b35edf195c10f0d5750c
SHA256

a689b27afa67609b9b73465c47f927a12c470b32d8a340552d5f85499501a757
SHA512

cc4af4a8994da26f6daacf1243bb85df0995eccb90159df66e94af0e4e9fd3df401e35a57254efe9bc10a45867dbbdcb3335391f4d5da8b2dcfbe31980e23ebf

Score

10^/10

icedid 1101171172 banker suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

1101171172

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1328 452 WerFault.exe regsvr32.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

regsvr32.exe

pid process

452 regsvr32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

regsvr32.exeWerFault.exe

pid process

452 regsvr32.exe
452 regsvr32.exe
1328 WerFault.exe
1328 WerFault.exe
1328 WerFault.exe
1328 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1328 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1328 WerFault.exe

pid	pid_target	process	target process
1328	452	WerFault.exe	regsvr32.exe

pid	process
452	regsvr32.exe

pid	process
452	regsvr32.exe
452	regsvr32.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe

pid	process
1328	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1328	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

cmd.execmd.exeregsvr32.exe

description	pid	process	target process
PID 1220 wrote to memory of 872	1220	cmd.exe	cmd.exe
PID 1220 wrote to memory of 872	1220	cmd.exe	cmd.exe
PID 1220 wrote to memory of 872	1220	cmd.exe	cmd.exe
PID 872 wrote to memory of 452	872	cmd.exe	regsvr32.exe
PID 872 wrote to memory of 452	872	cmd.exe	regsvr32.exe
PID 872 wrote to memory of 452	872	cmd.exe	regsvr32.exe
PID 872 wrote to memory of 452	872	cmd.exe	regsvr32.exe
PID 872 wrote to memory of 452	872	cmd.exe	regsvr32.exe
PID 452 wrote to memory of 1328	452	regsvr32.exe	WerFault.exe
PID 452 wrote to memory of 1328	452	regsvr32.exe	WerFault.exe
PID 452 wrote to memory of 1328	452	regsvr32.exe	WerFault.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\documents.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start regsvr32.exe data.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Windows\system32\regsvr32.exe
    regsvr32.exe data.dll
    3⤵
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:452
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 452 -s 244
      4⤵
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:1328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/452-56-0x00000000005B0000-0x00000000005BE000-memory.dmp

Filesize
56KB

Download
memory/1220-54-0x000007FEFC321000-0x000007FEFC323000-memory.dmp

Filesize
8KB

Download
memory/1328-58-0x0000000001E60000-0x0000000001E61000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing