icedid | de876c893ff521367bf117909a1a7760ec8a65d64b94a0d70cfbb0644443fc8c | Triage

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
21-02-2022 09:44

Sharing

Report Analysis Logs

General

Target

de876c893ff521367bf117909a1a7760ec8a65d64b94a0d70cfbb0644443fc8c.dll
Size

490KB
MD5

7b13d75b2c889a5358200ba16f1cd4bf
SHA1

158a4be536b439727fd563be00fdda37c4185149
SHA256

de876c893ff521367bf117909a1a7760ec8a65d64b94a0d70cfbb0644443fc8c
SHA512

6733437407b81fb2ac4c3de85f8dae218fe5a67f685009b342f50f9431a088123eb4a1f9f259a2a3893560f5509bdf48ae11e3401698dfd35e8f9a7e18d88544

Score

10^/10

icedid 3467965077 banker suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

3467965077

C2

firenicatrible.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata

Drops file in Windows directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

2316 regsvr32.exe
2316 regsvr32.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeShutdownPrivilege	4544	svchost.exe
Token: SeCreatePagefilePrivilege	4544	svchost.exe
Token: SeShutdownPrivilege	4544	svchost.exe
Token: SeCreatePagefilePrivilege	4544	svchost.exe
Token: SeShutdownPrivilege	4544	svchost.exe
Token: SeCreatePagefilePrivilege	4544	svchost.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\de876c893ff521367bf117909a1a7760ec8a65d64b94a0d70cfbb0644443fc8c.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2316-133-0x0000000000E00000-0x0000000000E0E000-memory.dmp

Filesize
56KB

Download
memory/4544-130-0x000001FE8D130000-0x000001FE8D140000-memory.dmp

Filesize
64KB

Download
memory/4544-131-0x000001FE8D190000-0x000001FE8D1A0000-memory.dmp

Filesize
64KB

Download
memory/4544-132-0x000001FE8FE90000-0x000001FE8FE94000-memory.dmp

Filesize
16KB

Download