icedid | b3608f2907d2924d576fd27f1feda3a03695683fdfec2130a9a59426c0432870

General

Target

core.bat

Score

10^/10

icedid 2406015698 banker collection core_loader core_payload spyware stealer trojan

Malware Config

Extracted

Family

icedid

Botnet

2406015698

C2

commamimubebe.site

asredetyr.site

aszepolityu.fun

likoportio.fun

Attributes

auth_var
6
url_path
/news/

Extracted

Family

icedid

rsa_pubkey.plain

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

3 1316 rundll32.exe
5 1316 rundll32.exe
6 1316 rundll32.exe
7 1316 rundll32.exe
8 1316 rundll32.exe
10 1316 rundll32.exe
Downloads MZ/PE file
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1316 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

flow	pid	process
3	1316	rundll32.exe
5	1316	rundll32.exe
6	1316	rundll32.exe
7	1316	rundll32.exe
8	1316	rundll32.exe
10	1316	rundll32.exe

Accesses Microsoft Outlook profiles 1 TTPs 7 IoCs

collection

Email Collection

T1114

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Discovers systems in the same network 1 TTPs 2 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exenet.exe

pid process

1288 net.exe
2044 net.exe
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exe

pid process

1988 ipconfig.exe
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

628 systeminfo.exe

pid	process
1288	net.exe
2044	net.exe

pid	process
1988	ipconfig.exe

pid	process
628	systeminfo.exe

Modifies registry class 2 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\CLSID\{31078542-23FA-1C81-3997-318CE05E65A3}\ = 797e730b079cbd7759641fb71b1caf7f6b9cefae3440626facff952de612bb7dc8af4ba520b3c5a22b864111f0b3a5bbc6bc69adc9d0c160bead1c733dc267c132ad3d41ad655bb1264d82d9efbd90079cca82e7da620ec6b55b9708eacfd8d2a001fe144dce3b092e6ac664473cce89267fc484adeea02455cd563a995d06912dd31cf86bead3ed899eab8b8620ce16dc0022bc046374dc88bc89ee683dc8e0eae3ed29711c4d4447c4882450cc603dd10c6e744244df0f26b7943ac84d38a504feede1ee29719c0ff86834d98682b68eec969e34c1b9f171a980e17608ad137c2843964526b882b71ef2ea6bb184354f0f334a4af911e1f174f7fd46ba	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000_CLASSES\CLSID\{31078542-23FA-1C81-3997-318CE05E65A3}	rundll32.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe
1316	rundll32.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

Processes:

WMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1172	WMIC.exe
Token: SeSecurityPrivilege	1172	WMIC.exe
Token: SeTakeOwnershipPrivilege	1172	WMIC.exe
Token: SeLoadDriverPrivilege	1172	WMIC.exe
Token: SeSystemProfilePrivilege	1172	WMIC.exe
Token: SeSystemtimePrivilege	1172	WMIC.exe
Token: SeProfSingleProcessPrivilege	1172	WMIC.exe
Token: SeIncBasePriorityPrivilege	1172	WMIC.exe
Token: SeCreatePagefilePrivilege	1172	WMIC.exe
Token: SeBackupPrivilege	1172	WMIC.exe
Token: SeRestorePrivilege	1172	WMIC.exe
Token: SeShutdownPrivilege	1172	WMIC.exe
Token: SeDebugPrivilege	1172	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1172	WMIC.exe
Token: SeRemoteShutdownPrivilege	1172	WMIC.exe
Token: SeUndockPrivilege	1172	WMIC.exe
Token: SeManageVolumePrivilege	1172	WMIC.exe
Token: 33	1172	WMIC.exe
Token: 34	1172	WMIC.exe
Token: 35	1172	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1172	WMIC.exe
Token: SeSecurityPrivilege	1172	WMIC.exe
Token: SeTakeOwnershipPrivilege	1172	WMIC.exe
Token: SeLoadDriverPrivilege	1172	WMIC.exe
Token: SeSystemProfilePrivilege	1172	WMIC.exe
Token: SeSystemtimePrivilege	1172	WMIC.exe
Token: SeProfSingleProcessPrivilege	1172	WMIC.exe
Token: SeIncBasePriorityPrivilege	1172	WMIC.exe
Token: SeCreatePagefilePrivilege	1172	WMIC.exe
Token: SeBackupPrivilege	1172	WMIC.exe
Token: SeRestorePrivilege	1172	WMIC.exe
Token: SeShutdownPrivilege	1172	WMIC.exe
Token: SeDebugPrivilege	1172	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1172	WMIC.exe
Token: SeRemoteShutdownPrivilege	1172	WMIC.exe
Token: SeUndockPrivilege	1172	WMIC.exe
Token: SeManageVolumePrivilege	1172	WMIC.exe
Token: 33	1172	WMIC.exe
Token: 34	1172	WMIC.exe
Token: 35	1172	WMIC.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

cmd.exerundll32.execmd.exenet.exenet.exe

description	pid	process	target process
PID 912 wrote to memory of 1068	912	cmd.exe	rundll32.exe
PID 912 wrote to memory of 1068	912	cmd.exe	rundll32.exe
PID 912 wrote to memory of 1068	912	cmd.exe	rundll32.exe
PID 912 wrote to memory of 324	912	cmd.exe	rundll32.exe
PID 912 wrote to memory of 324	912	cmd.exe	rundll32.exe
PID 912 wrote to memory of 324	912	cmd.exe	rundll32.exe
PID 912 wrote to memory of 892	912	cmd.exe	rundll32.exe
PID 912 wrote to memory of 892	912	cmd.exe	rundll32.exe
PID 912 wrote to memory of 892	912	cmd.exe	rundll32.exe
PID 912 wrote to memory of 1900	912	cmd.exe	rundll32.exe
PID 912 wrote to memory of 1900	912	cmd.exe	rundll32.exe
PID 912 wrote to memory of 1900	912	cmd.exe	rundll32.exe
PID 912 wrote to memory of 936	912	cmd.exe	rundll32.exe
PID 912 wrote to memory of 936	912	cmd.exe	rundll32.exe
PID 912 wrote to memory of 936	912	cmd.exe	rundll32.exe
PID 912 wrote to memory of 1184	912	cmd.exe	rundll32.exe
PID 912 wrote to memory of 1184	912	cmd.exe	rundll32.exe
PID 912 wrote to memory of 1184	912	cmd.exe	rundll32.exe
PID 912 wrote to memory of 1740	912	cmd.exe	rundll32.exe
PID 912 wrote to memory of 1740	912	cmd.exe	rundll32.exe
PID 912 wrote to memory of 1740	912	cmd.exe	rundll32.exe
PID 912 wrote to memory of 1316	912	cmd.exe	rundll32.exe
PID 912 wrote to memory of 1316	912	cmd.exe	rundll32.exe
PID 912 wrote to memory of 1316	912	cmd.exe	rundll32.exe
PID 1316 wrote to memory of 1892	1316	rundll32.exe	cmd.exe
PID 1316 wrote to memory of 1892	1316	rundll32.exe	cmd.exe
PID 1316 wrote to memory of 1892	1316	rundll32.exe	cmd.exe
PID 1892 wrote to memory of 1532	1892	cmd.exe	chcp.com
PID 1892 wrote to memory of 1532	1892	cmd.exe	chcp.com
PID 1892 wrote to memory of 1532	1892	cmd.exe	chcp.com
PID 1316 wrote to memory of 1172	1316	rundll32.exe	WMIC.exe
PID 1316 wrote to memory of 1172	1316	rundll32.exe	WMIC.exe
PID 1316 wrote to memory of 1172	1316	rundll32.exe	WMIC.exe
PID 1316 wrote to memory of 1988	1316	rundll32.exe	ipconfig.exe
PID 1316 wrote to memory of 1988	1316	rundll32.exe	ipconfig.exe
PID 1316 wrote to memory of 1988	1316	rundll32.exe	ipconfig.exe
PID 1316 wrote to memory of 628	1316	rundll32.exe	systeminfo.exe
PID 1316 wrote to memory of 628	1316	rundll32.exe	systeminfo.exe
PID 1316 wrote to memory of 628	1316	rundll32.exe	systeminfo.exe
PID 1316 wrote to memory of 1936	1316	rundll32.exe	net.exe
PID 1316 wrote to memory of 1936	1316	rundll32.exe	net.exe
PID 1316 wrote to memory of 1936	1316	rundll32.exe	net.exe
PID 1936 wrote to memory of 896	1936	net.exe	net1.exe
PID 1936 wrote to memory of 896	1936	net.exe	net1.exe
PID 1936 wrote to memory of 896	1936	net.exe	net1.exe
PID 1316 wrote to memory of 952	1316	rundll32.exe	nltest.exe
PID 1316 wrote to memory of 952	1316	rundll32.exe	nltest.exe
PID 1316 wrote to memory of 952	1316	rundll32.exe	nltest.exe
PID 1316 wrote to memory of 1740	1316	rundll32.exe	nltest.exe
PID 1316 wrote to memory of 1740	1316	rundll32.exe	nltest.exe
PID 1316 wrote to memory of 1740	1316	rundll32.exe	nltest.exe
PID 1316 wrote to memory of 1288	1316	rundll32.exe	net.exe
PID 1316 wrote to memory of 1288	1316	rundll32.exe	net.exe
PID 1316 wrote to memory of 1288	1316	rundll32.exe	net.exe
PID 1316 wrote to memory of 2044	1316	rundll32.exe	net.exe
PID 1316 wrote to memory of 2044	1316	rundll32.exe	net.exe
PID 1316 wrote to memory of 2044	1316	rundll32.exe	net.exe
PID 1316 wrote to memory of 1076	1316	rundll32.exe	net.exe
PID 1316 wrote to memory of 1076	1316	rundll32.exe	net.exe
PID 1316 wrote to memory of 1076	1316	rundll32.exe	net.exe
PID 1076 wrote to memory of 1892	1076	net.exe	net1.exe
PID 1076 wrote to memory of 1892	1076	net.exe	net1.exe
PID 1076 wrote to memory of 1892	1076	net.exe	net1.exe

outlook_office_path 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

outlook_win_path 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:912

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\clutch-32.tmp,DllMain /i="license.dat"
2⤵
PID:1068

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\clutch-32.tmp,update /i="license.dat"
2⤵
PID:324

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\clutch-32.tmp,A4COce1ujFb /i="license.dat"
2⤵
PID:892

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\clutch-32.tmp,AcxGpz /i="license.dat"
2⤵
PID:1900

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\clutch-32.tmp,B2GHGNnvPg2 /i="license.dat"
2⤵
PID:936

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\clutch-32.tmp,BeNLJAyZnN8 /i="license.dat"
2⤵
PID:1184

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\clutch-32.tmp,Bh012VLJC0z /i="license.dat"
2⤵
PID:1740

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\clutch-32.tmp,Bjaskkas /i="license.dat"
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1316

C:\Windows\system32\cmd.exe
cmd.exe /c chcp >&2
3⤵
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\system32\chcp.com
chcp
4⤵
PID:1532

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get * /Format:List
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1172

C:\Windows\system32\ipconfig.exe
ipconfig /all
3⤵
- Gathers network information
PID:1988

C:\Windows\system32\systeminfo.exe
systeminfo
3⤵
- Gathers system information
PID:628

C:\Windows\system32\net.exe
net config workstation
3⤵
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 config workstation
4⤵
PID:896

C:\Windows\system32\nltest.exe
nltest /domain_trusts
3⤵
PID:952

C:\Windows\system32\nltest.exe
nltest /domain_trusts /all_trusts
3⤵
PID:1740

C:\Windows\system32\net.exe
net view /all /domain
3⤵
- Discovers systems in the same network
PID:1288

C:\Windows\system32\net.exe
net view /all
3⤵
- Discovers systems in the same network
PID:2044

C:\Windows\system32\net.exe
net group "Domain Admins" /domain
3⤵
- Suspicious use of WriteProcessMemory
PID:1076

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 group "Domain Admins" /domain
4⤵
PID:1892

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

3

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\license.dat
Filesize
334KB

MD5
c3db0f946699412e8f3a2775516116a2

SHA1
a01448e2760dcb2fbed70a634baaae559d3b6de0

SHA256
dbe9743c9c57247cb9275a23a84909dd78aca59f584df62197bde07cb87bd1ed

SHA512
50b2e9b3446463f4b02980587b3f4bd716f5b018e26085f10d38c42fd0f6e07891438d13ccc5b36f38ab9c7f1ea874814ed266f8551a970c8ca3eb73ac6b4950

Download Submit
\Users\Admin\AppData\Local\Temp\sqlite64.dll
Filesize
1.8MB

MD5
26d773a69f6fad3200d49a7aaa77752b

SHA1
3970ffe8aefe0c30daaec65b85fb103c0fc0f2a7

SHA256
fca6b7fe66ad9973f18f407e83b56dacd04197cbd35efc498a342d73d6a113e5

SHA512
0041b52514460dda19dd065fc46393f6fbe248a4c62fce28e0819abd952756996b34fdea286eb7814a7c868a12656a065278932760e61e53f7102b0dba324e4f

Download Submit
memory/324-55-0x0000000000000000-mapping.dmp

Download
memory/628-76-0x0000000000000000-mapping.dmp

Download
memory/892-56-0x0000000000000000-mapping.dmp

Download
memory/896-78-0x0000000000000000-mapping.dmp

Download
memory/936-58-0x0000000000000000-mapping.dmp

Download
memory/952-79-0x0000000000000000-mapping.dmp

Download
memory/1068-54-0x0000000000000000-mapping.dmp

Download
memory/1076-83-0x0000000000000000-mapping.dmp

Download
memory/1172-74-0x0000000000000000-mapping.dmp

Download
memory/1184-59-0x0000000000000000-mapping.dmp

Download
memory/1288-81-0x0000000000000000-mapping.dmp

Download
memory/1316-62-0x0000000180000000-0x0000000180005000-memory.dmp

Filesize
20KB

Download
memory/1316-67-0x0000000001DD0000-0x0000000001E29000-memory.dmp

Filesize
356KB

Download
memory/1316-61-0x0000000000000000-mapping.dmp

Download
memory/1316-86-0x0000000003A70000-0x0000000003C48000-memory.dmp

Filesize
1.8MB

Download
memory/1532-73-0x0000000000000000-mapping.dmp

Download
memory/1740-80-0x0000000000000000-mapping.dmp

Download
memory/1740-60-0x0000000000000000-mapping.dmp

Download
memory/1892-72-0x0000000000000000-mapping.dmp

Download
memory/1892-84-0x0000000000000000-mapping.dmp

Download
memory/1900-57-0x0000000000000000-mapping.dmp

Download
memory/1936-77-0x0000000000000000-mapping.dmp

Download
memory/1988-75-0x0000000000000000-mapping.dmp

Download
memory/2044-82-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads