icedid | 769d81961956246bbb3890bd3a0c46393b2c068cb0a487c62a9c5633314c2cb6 | Triage

Analysis

max time kernel
140s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
29-03-2022 02:01

Sharing

Report Analysis Logs

General

Target

download.exe
Size

20KB
MD5

f6f39450a7a21f279fe9c30e1d33fe26
SHA1

4a758582a9a1d98a3696718645d4a15649cb622c
SHA256

769d81961956246bbb3890bd3a0c46393b2c068cb0a487c62a9c5633314c2cb6
SHA512

0db0fc34e31bb3d86448e59356657cc32830f58e96ddf2a5a695a8ca6ba362a76659d66d7b877996e0478654b54a1b7db20bae9f15a488dcb364341b451b66c7

Score

10^/10

icedid 3714063495 banker suricata trojan

Malware Config

Extracted

Family

icedid

Campaign

3714063495

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata

Modifies data under HKEY_USERS 6 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e00000000020000000000106600000001000020000000b07161a9935511eb83bdf8755862fb919c07fa40b0f71258874dd88017897b1f000000000e8000000002000020000000cf3643ef1efbfd2f153e3202f39d4f0b59e0a4a5e8a6a2dd3d262eb57d2d163a100d00002cd955b650668e5832b6b90547f74e679b7af345fe8e73597923528017e491f3b63891adf6c0ef1170b5a6a68cbdbfb6f04413a50dd3320cb23a48a51c8f50cba70367e363b0160f3fe6184de2173fb24dc44eea2ba16cf58a1e3d90d0c6ff00e81689dfff03d0fbbab029ba850bc124834399b6e999165ad660872c2ef8ee34247a67a57d5fc9bf393130665a81c44a3c769a9c5501010a2ab1c17f0d97f2e740962992ac11009d8095da28d586e72dbd686477eb598f93aca166e0005e9a5c16d4a32156fae91529db1be14dc1a5474a7e93e52ca8ecb2bc102476c6cfcc5de078b415ff596e83781e768c57b0b76e559ee7802ba57a73ccaa889b21f1cf2632fea43ea3fc53ddf3011f689a8f9f5b598330ab33c11a11c0525b94c5dd6892d46433cbec2aeb0e7c684344c80aebbcd14219cce2a591f145fdbbec9b4c0e9785ee039380601ffda36d13e3e099049033197e283c195bf73ed181ebe137977ad6b6dce2eed532dc468d396c840d4eb1923fa3c1f98cb3a6231900c7620e823ad90bfed2a0840cc0927e1c3210a7e53276fde3ef05a055e8fba58736323cdc4ab1264d0ff3814a57663859087ce339d1d29e596fbad190ad97d070f6befa45588ae1b1d9d7e66d7de33ee2ab92a7cb75b2b1b28f6fa714f9dc7a8459718ce68618526f36bf3cbc412fe1bdb1146c5925f439631e7817c6951630e16e119478945bbd2a4047f444a681a3d3438d7be90ae8a82b59544f19b2ea8e9242308ec1697cbf68c4a4c812fdb7dd3f47c423cdf79a1af6b3ccf02eb32f909bb8ef570e615a36aa71e084f307474d48c23137499321340f6f415f24aaff34b9add9e9cc69a92e28e5f2179574538087384ec7336ee1b00e1415d46424d14764fb908d81185653240f11eeded20b6cdec81c1e517d9ac05e49217d8e83cc0fe8e4bcc8a4b146ae6c046943b64fe3af7e1d734f8cf858c16af8418fc71c68a40d2866fc7bc6bcbbdfeaf83911c569952013bc94d1cfd4b25954bc26b3c0b93a60bf7996ef738e5a281833aede82f5338d85e1a8eb2aae401daa89a635a8f6fc9f9bed59feaa614b6fe57a3aacbf1e7e35bd936d46aa3b9785b0b45752be3cb44df4af3bdca6f2d2df1d8e685b04d9d943de47ce601d29481124bc12a3e277d19cf3d7904d65c5f3be044fa01a61f4a2b74e4bc43d39f7fa9fa6614fdd11f53c26182075684deae267d3b20c7a7a4b245726e9e5fd0d1069c4affe573669a8a986bb8cbda1bda251d0d8bd9d061917f991a37b013365b50ce04b1c137dba543b6cec2b89e4f40ced68213434809eb81cac5d8707f50969c4dd280f0313bccbfce7462dc40f1f61efa3946530f4344bbb5d2fd9ccbad04255ffd9aa531c83e8c0b461a68f6800a4e602335ff2c65f602c1b0e4e0957e75e67c7527c097f61136928726c76d14a9da23492d48f94f9b53109258f5f4c1b93c31c7c10b261fc7959530e9ecaee44fb78b3487c98f62b216d7461272ca3c09576d5e3acca61a268be913bd706d1e7a5140b27cce18c0be3736330fbbf159d1280c06e783578c3021b6ff9c21ac8857ba65e908e55dad9c2594ef9af59602c9df6be8c18ab4cb29a5c050f8d6c675aae76e788e443f58916dabf7c2cc62053ecc55b270233e9edbd5e0c9780e2e7e3dd870ffd054dd0b6f291d777a72cf6b2beeec8d7394399c7c2a6110038761c7099ff104b43c87d86f123d4025776a8b3c191343ac5bc77be5affb85cafd9397bad5877f14f8fedc446453598370716dfb2425c9b2f92489d24e15919ea31bc4bdade5e71f5c9acd49a7367b1977cc996a67cb4a7b00f7a6c8703d6defa770b39c7c050edd78b85eddf2da5421f59aa7bf97342e59b5642bf201537cdfa503cfc4c1ef5ddf7deee55d2c4804691938091091a88d26388afabccfe54bc2b588e59e61aa60556045b5b5459558d68275403b9229b69e6d363517aff1cc879d1de139e14cdcf0b824597f3b5b268646b906f41d6ee2655ee431efe8fd0206591f1a9fb26aed880c3316311267ba631bafd447fd3e39a98fdcf971d0cefa2a357509632bd1ce46cc4d012ca1327f858039566aaf57f10b9ba388ab907634235e93b3dd248cebd93971ffc62ca3dc13e28ac698756836a29f8b0f6604d1e989a65168924a77f5432ee3f3bb376386e205bd998ffb4be17b443488efd10d5b16f63b1eb9ff79b10bed0f8810546348618a1930c855c1727ee15180dac0e4ce0a161e18e0eb793ad0f23039d4df95250c9ba0527110c06cbc442a97c9ab4ccbecabfba7c19fa1ce2eb3689eef20296331a3301ad858b733966f7f8c73466565ee38c77181a5efa467ee142b87703eb3a25c5acdd9752561acf6df227ee32dd9381f1f7bdc6d11b33b7d645ce53f65302752235774db38a46b3b97f968ee247f83cfb8986a03436e3c0f3eb577251885abcb84a30260b51d626c87ea239ca5c4ff497b8563a68db85e1da643d537075a79af9304de2886c1b0dbad4af77bafcc76fb7d249da3288321caa36b36a29e97107217bfe6028c31a0793093c029955f5e9c1373c0f451663acd839196e8c089b1732996021591a81dab1de24b33103806bef94011280094e7d007c60b77b93df9e19ab7026652ae310421a8c85b86df6c4943ac5100acbb2ac3255e358a776477c47f4a5a18633abadb3925a0c26d2c754a9cc888a785b913fb4bf80d04ebeacc628ebc6bf24b57e1b04b4bc175fe3636303d33bc75aa558e18ab4335fd76d89ba23d7567750d28dfc738fcad6fbfd8738b09e2302889fcad601e9dcda7fc6be6f3a7fd50f2d68231dda13ffd578c241e58a5ebc179f6baa56af6b435bfe3ca84a709e77883c01144ce8ef3884cb2dd8993e29ab98fc9b88caf6895cd62bdf3e77d08466713d5c01ab03b995bbbebba9afa60932202bfa245875c70fc6ec7b3a90c6700725ef9590bdfa520d7e862e413a3c44b3c19c3e91316d78f67bf5647d12e1e8d9950f55a2b0d92b3432ffff60d18bc6360e4928fa979d0a2020e8c487e97f18759494b9e687cc0d058d263f2eb5dd2718adb7bb810ba20acfdd04e261c06de3f23bbe286b28ddf41ada54e49e6e9e2d77805938dbde7b7f74e0b3fbf536b20247238ad4eab3d4a1994d3156e10568e25f97148f0973de2c6c67e2f21fdd1dcb311641d2ff6394c94aec69ff3e8319fdc2f773630f549028b89760532c315c9f1a757b7a9cc97c918f604018742544ac91ec91e4353b4dad29c50872d61acc71d45c601bef506daa391726beabcdc324b7208b64a017f51ca1d4c793e8066209f7b4c2ffb6f318aac553ab5014e53979e0204e5bd3e91ea9f3d196683b299ae1123b9ee59b0919318037a5bac84b207520e630c75c33445709d612382cd69be9ee7c16faf68164efd0905001b340228690a766f682aa388682e09806f4ac5dbc0b90f7ff409c1e5fb5a4e5926683dc222c7f033438cc333cbc87e1271fe9e3947511254715b5fd95ef0dcd38f21345754048e52263faa3ac3b546f005fc9076aebb54bdd5874cda9b76c63190cd752545ebf72ec1cbfc1c3cb91b67d491a76b24e7073d68c02d4b540d26c601bd1cd7fd15d96179f807c3944872732ce1034dc250653141fa79fc5c850a2dc968d83c05ef3c52c3d7030c8c192a36c47565c5e3dde82e102ac051fb770b2580c52916b7b21c68057c9a67e46fb1cdfb3ce50d6f5c7dcf3a8ee4f0d4568daee5600a5fad4a88ae1eb25dad623662c7f57b5baf2989bbcabeb43120790bd1412fb57a2417ba3708b00271ba6aa96d54270ff38accc27046eeaecf7d74ff78e7d3ff1c7ea526657ae378e8586d49dbde6c0b6b273a14bab6833522e66084e52b00a1a025a0097b67270cea1d2b763ca11209da9b17b1031801f5adaae1cc784c784351a4a595a7415364e4de4a631910b2caa2fa8603e22f1343449803ee294d85c7458db2ec921baf81bf8df474b82fa11b989e86354f84ca182b698965ab610c641a22347192c5054e272b740c13c2379c4629fbfc61edf0131a2f0dbfd58e69185ab191f8762aa6423d12cd2b28a650b6e7364d4f460fe05ea2c88741f972b3abcbb5fdc417c6e6bcca8bcccb500418c2d3a24916c29bdc236f71a92b165f9f5247155fcdddbe16f932005a15e906eadbec84fc3dd8775e68df8287ba17c17754999da06122a066516743e15ba8cd9f2675d1a803868998627c2412dadab0e1f7a651d96ea1d8cef1c3c5d284516ee489958850d636de2a37c3e1dceff09b571ad2b3c4c04ab41132b31bc39f36edaf8ea7ab33fb34a9f67922a3f7881173759eafb3eb308807f26d7118a9124f2612322ef7a5f6310516c656689d2a0a2905153fe2c95d34738f8c001c71a60fdd8bf3831d158faa320830d9ae773fb65fabd9f22925c27572178f1f127bf40319394262ee50beebf27965302b1f85aae73a2276555295c2c0a10596c68e74508ea6fc09f694bb85dae67a441c8f40bce958bb185ed5d147723155b551a1cd8192040f895a346ac121b035ae497cf7fded931183dc086cba40a23313c3c975dd9e2b63b6d20b9caa8f9b2b64549b2cca0052c99325458e7af6b41ecf0621c8116b7becb9efaa8487b61debcc88846590a7b18efbf62a84aa3741aa4f4b5151abc5ae82c3544c0bdf99a929f1df351bef6195da406456a0d26a8d2bfca27493f833000d2dd444d4000000080b8e4b039b77b9c2ccfd9cbfd1d0b0cde6e346dcc3051d1513685016d4e290e9d0f17d0ef0826d25eeb7c6784a4f9ad5c7abd9051712d42e760a0916dab6dba	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "001840066E79878A"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\001840066E79878A = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000006f29ab57d4ede7ca3ad191c68cf2cbd7861db1e6915cff3dc44fa3782efbbf7c000000000e8000000002000020000000640eab0db81ca44e6c870e35b58ca53f2b9563217e72a011b724410e19633cb680000000f2b51fce1799667c262a6a0c454f93ca7fd9f995dd7c7596df79ec3028312cf642497d2ec0667a791beb5d177b971134eab238bf0ee17a7ba16a494b2a168aba100a2eed0a3348379e6c345524629ace20cb617c8d0ed7b294f35e8cd8aabeefd69065cd6cd17aed5f15d25ce61a5a00ec73958c8651a343a5b9c4daa18d3ba6400000005240cfee3b8b599f6def3608ea4b1c72f3a6c21b7758b3ebf885613d14707e3d8ac48b26fe240b5a18196481a7216bcaa9e88352d663d3512846c44769a2479d	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

download.exe

pid process

3648 download.exe
3648 download.exe

C:\Users\Admin\AppData\Local\Temp\download.exe
"C:\Users\Admin\AppData\Local\Temp\download.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3648

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
- Modifies data under HKEY_USERS
PID:556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads