icedid | a165afab97fecd6212eb82933abd224eaca434202023e4e36f6698f4334cfc96 | Triage

Analysis

max time kernel
131s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
21-02-2022 09:48

Sharing

Report Analysis Logs

General

Target

a165afab97fecd6212eb82933abd224eaca434202023e4e36f6698f4334cfc96.dll
Size

490KB
MD5

bc65544733d6c44a373ec85b51f049e7
SHA1

a6028e343dbef3a6aa01d37aafe64a6e9c76aa4f
SHA256

a165afab97fecd6212eb82933abd224eaca434202023e4e36f6698f4334cfc96
SHA512

b336462f4cf7de4c1916ec440f6b370bef3c5f15dbc81d74b7df90786359bd374d35d94fd5864d81c14fef6e4d6edd622627912ebd48524494e162eea4a067e9

Score

10^/10

icedid 3467965077 banker suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

3467965077

C2

firenicatrible.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata

Drops file in Windows directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

3484 regsvr32.exe
3484 regsvr32.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeShutdownPrivilege	1964	svchost.exe
Token: SeCreatePagefilePrivilege	1964	svchost.exe
Token: SeShutdownPrivilege	1964	svchost.exe
Token: SeCreatePagefilePrivilege	1964	svchost.exe
Token: SeShutdownPrivilege	1964	svchost.exe
Token: SeCreatePagefilePrivilege	1964	svchost.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a165afab97fecd6212eb82933abd224eaca434202023e4e36f6698f4334cfc96.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1964-130-0x000001DB2C780000-0x000001DB2C790000-memory.dmp

Filesize
64KB

Download
memory/1964-131-0x000001DB2CFE0000-0x000001DB2CFF0000-memory.dmp

Filesize
64KB

Download
memory/1964-132-0x000001DB2F500000-0x000001DB2F504000-memory.dmp

Filesize
16KB

Download
memory/3484-133-0x0000000002700000-0x000000000270E000-memory.dmp

Filesize
56KB

Download