icedid | 0f5fbad82dae02e2a48775762f8ff0eb067eb4f81ce637607ac893d4e0c613b3 | Triage

Analysis

max time kernel
163s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
19-02-2022 18:06

Sharing

Report Analysis Logs

General

Target

2d1655895c0dde4bc010c51b9b878c46.dll
Size

570KB
MD5

2d1655895c0dde4bc010c51b9b878c46
SHA1

fb73914210b56c020a816325b3a5adb185e8f3ee
SHA256

0f5fbad82dae02e2a48775762f8ff0eb067eb4f81ce637607ac893d4e0c613b3
SHA512

08947de9e604fde5ef451302ba0591999aa864f96577986cdeebe2f9325e2f936940deb413bf872c94e9007c9997fd036f25a30208f763cfd163860b624aeed1

Score

10^/10

icedid 1117948791 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

1117948791

C2

reseptors.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Drops file in Windows directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

3560 regsvr32.exe
3560 regsvr32.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeShutdownPrivilege	2692	svchost.exe
Token: SeCreatePagefilePrivilege	2692	svchost.exe
Token: SeShutdownPrivilege	2692	svchost.exe
Token: SeCreatePagefilePrivilege	2692	svchost.exe
Token: SeShutdownPrivilege	2692	svchost.exe
Token: SeCreatePagefilePrivilege	2692	svchost.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2d1655895c0dde4bc010c51b9b878c46.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2692-130-0x000001A424A20000-0x000001A424A30000-memory.dmp

Filesize
64KB

Download
memory/2692-131-0x000001A424A80000-0x000001A424A90000-memory.dmp

Filesize
64KB

Download
memory/2692-132-0x000001A427150000-0x000001A427154000-memory.dmp

Filesize
16KB

Download
memory/3560-133-0x0000000002B00000-0x0000000002B0E000-memory.dmp

Filesize
56KB

Download