icedid | d7d1b9741379727173f41cad5792e11693100222242a03f8354819b4528f8b27 | Triage

Analysis

max time kernel
137s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
21-02-2022 09:35

Sharing

Report Analysis Logs

General

Target

d7d1b9741379727173f41cad5792e11693100222242a03f8354819b4528f8b27.dll
Size

490KB
MD5

43ecdeb5738fbd30773987fa3dee763e
SHA1

830ef25efa3de56600cf5ac4bcc23815c28aeb5b
SHA256

d7d1b9741379727173f41cad5792e11693100222242a03f8354819b4528f8b27
SHA512

51592bb77a9f80a631295af51c8a214259325e085f842efaeb165b14a069784d7509dd0ec5f9176037c3d73d7c24b2e5c4543dca36a66fe8847d5ac812ed21a4

Score

10^/10

icedid 3467965077 banker trojan

Malware Config

Extracted

Family

icedid

Campaign

3467965077

C2

firenicatrible.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Drops file in Windows directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

3652 regsvr32.exe
3652 regsvr32.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeShutdownPrivilege	1644	svchost.exe
Token: SeCreatePagefilePrivilege	1644	svchost.exe
Token: SeShutdownPrivilege	1644	svchost.exe
Token: SeCreatePagefilePrivilege	1644	svchost.exe
Token: SeShutdownPrivilege	1644	svchost.exe
Token: SeCreatePagefilePrivilege	1644	svchost.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d7d1b9741379727173f41cad5792e11693100222242a03f8354819b4528f8b27.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1644-134-0x0000021B39020000-0x0000021B39030000-memory.dmp

Filesize
64KB

Download
memory/1644-133-0x0000021B38970000-0x0000021B38980000-memory.dmp

Filesize
64KB

Download
memory/1644-135-0x0000021B3B6F0000-0x0000021B3B6F4000-memory.dmp

Filesize
16KB

Download
memory/3652-136-0x0000000000E40000-0x0000000000E4E000-memory.dmp

Filesize
56KB

Download