icedid | 66e3893430e6f89b5f0d7d14f113fe60bbe2e3da15b42ec8295fc52579f7a453 | Triage

Analysis

max time kernel
137s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
19-02-2022 18:46

Sharing

Report Analysis Logs

General

Target

993c7c4b8bf40f06edf8ac8d32983abb.dll
Size

588KB
MD5

993c7c4b8bf40f06edf8ac8d32983abb
SHA1

63fbfa56a4bcd8b98c5e0dc3ee4e3cfb786f3b65
SHA256

66e3893430e6f89b5f0d7d14f113fe60bbe2e3da15b42ec8295fc52579f7a453
SHA512

cc018993fc69093a2dfab22672e79591cebf251e16b0299afcad3dd4e631fe5797642d2e301449848f203c3b4bf6293e47a65e890115b2efadd41b54a4231eda

Score

10^/10

icedid 1117948791 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

1117948791

C2

reseptors.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Drops file in Windows directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

4044 regsvr32.exe
4044 regsvr32.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeShutdownPrivilege	3404	svchost.exe
Token: SeCreatePagefilePrivilege	3404	svchost.exe
Token: SeShutdownPrivilege	3404	svchost.exe
Token: SeCreatePagefilePrivilege	3404	svchost.exe
Token: SeShutdownPrivilege	3404	svchost.exe
Token: SeCreatePagefilePrivilege	3404	svchost.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\993c7c4b8bf40f06edf8ac8d32983abb.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3404-130-0x0000024FB3F70000-0x0000024FB3F80000-memory.dmp

Filesize
64KB

Download
memory/3404-131-0x0000024FB4A30000-0x0000024FB4A40000-memory.dmp

Filesize
64KB

Download
memory/3404-132-0x0000024FB6F40000-0x0000024FB6F44000-memory.dmp

Filesize
16KB

Download
memory/4044-133-0x0000000002DF0000-0x0000000002DFE000-memory.dmp

Filesize
56KB

Download