Overview

overview

10

Static

static

8

Мобіл...к.xls

windows10_x64

10

Resubmissions

15-04-2022 13:43

220415-q1fsrabhcr 10

15-04-2022 13:22

220415-qmkjsabael 10

Analysis

  • max time kernel
    94s
  • max time network
    76s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    15-04-2022 13:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Мобілізаційний список.xls

  • Size

    32KB

  • MD5

    3aa6bf4ed8c485717d767013d43f7cdb

  • SHA1

    83ea9a8627819a7ba2ecad058f22e7f697256bc0

  • SHA256

    08d30d6646117cd96320447042fb3857b4f82d80a92f31ee91b16044b87929c0

  • SHA512

    db51c36533565f35b535fa4696a8992c2b1fa15cf93fb129c3ec740a394b6bff3cf43355e172c017f8ed762d99a73f2d157a0fb797cd827a228db39195652a5b

Score
10/10
icedid2493865931bankerloadersuricatatrojan

Malware Config

Extracted

Family

icedid

Campaign

2493865931

C2

ertimadifa.com

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Loads dropped DLL 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Мобілізаційний список.xls"
    1⤵
    • Drops file in Windows directory
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2652
    • C:\Windows\SYSTEM32\rundll32.exe
      rundll32 C:\Windows\Tasks\su.dll, PluginInit
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:4044
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4764

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Tasks\su.dll
    Filesize

    150KB

    MD5

    89a0e6601d22c145a7dd5f5dd65b1f04

    SHA1

    0f964caafc104b44d371a71809f01ceca7a39128

    SHA256

    55df2954add86715fc3d728459d79a6d2b88d34d9f23fafe9c5a573bb773d9e9

    SHA512

    8082a826e48261eafd7bc446e88d7246b75715236825f35eef97d2badbf39b6bf22ec03a6101c89e5ae33a461da264d8f6dabf7a37428e751aa73d4139ae340f

    Download Submit

  • \Windows\Tasks\su.dll
    Filesize

    150KB

    MD5

    89a0e6601d22c145a7dd5f5dd65b1f04

    SHA1

    0f964caafc104b44d371a71809f01ceca7a39128

    SHA256

    55df2954add86715fc3d728459d79a6d2b88d34d9f23fafe9c5a573bb773d9e9

    SHA512

    8082a826e48261eafd7bc446e88d7246b75715236825f35eef97d2badbf39b6bf22ec03a6101c89e5ae33a461da264d8f6dabf7a37428e751aa73d4139ae340f

    Download Submit

  • memory/2652-118-0x00007FFC8F150000-0x00007FFC8F160000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2652-119-0x00007FFC8F150000-0x00007FFC8F160000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2652-120-0x00007FFC8F150000-0x00007FFC8F160000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2652-121-0x00007FFC8F150000-0x00007FFC8F160000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4044-260-0x0000000000000000-mapping.dmp

    Download

  • memory/4044-265-0x0000000180000000-0x0000000180009000-memory.dmp

    Filesize

    36KB

    Download