Overview

overview

10

Static

static

sac3p.7z

windows10_x64

10

Analysis

  • max time kernel
    921s
  • max time network
    941s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    30-06-2022 18:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sac3p.7z

  • Size

    222KB

  • MD5

    1dffe2464ff57e37a483c713f5823039

  • SHA1

    02d35e456b553be3ba9906c395386a7ec0dacb97

  • SHA256

    eac5d2ad5965e0c2da630487b93ba8922202720234df6ec941af3da66b4239cb

  • SHA512

    9aa19fa0444cc713c04330953cd54c980c5999d95ce18d21c9b4c1d4af6eff9d72611643226606538bea2584f46a3c33248fc27c2e7107e54ea35e8876c82417

Score
10/10
icedid3635541348bankerloadersuricatatrojan

Malware Config

Extracted

Family

icedid

Campaign

3635541348

C2

piponareatna.com

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata
  • Blocklisted process makes network request 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 57 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\sac3p.7z
    1⤵
    • Modifies registry class
    PID:3748
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4448
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4104
      • C:\Windows\explorer.exe
        explorer .
        3⤵
          PID:2936
        • C:\Windows\system32\rundll32.exe
          rundll32 sac3p.dll,#1
          3⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:364
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2256
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3580
      • C:\Program Files\7-Zip\7zG.exe
        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\" -an -ai#7zMap16611:88:7zEvent18434
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:4540
      • C:\Program Files\7-Zip\7zG.exe
        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\" -an -ai#7zMap1133:88:7zEvent23252
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:4684
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4608

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Modify Registry

      1
      T1112

      Credential Access

      Discovery

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\sac3p.dll
        Filesize

        424KB

        MD5

        d562ddfacb68466a719ebb035629bb5e

        SHA1

        349dbcd9a35fef4172028a4528a9359c0d51fe31

        SHA256

        57dfa7a0ea9b024f85fa46cf2c383b9c7b0800916c12a17b2f2b64010b2ef509

        SHA512

        dec42c080298452524d660f26dabb4444c02d5f2037ec2e72b8f18d021733203e1bd12eded656d5b29b40b999e020b7f34e1593e3fc1ff8de5809a7daa68374f

        Download Submit
      • \Users\Admin\AppData\Local\Temp\sac3p.dll
        Filesize

        424KB

        MD5

        d562ddfacb68466a719ebb035629bb5e

        SHA1

        349dbcd9a35fef4172028a4528a9359c0d51fe31

        SHA256

        57dfa7a0ea9b024f85fa46cf2c383b9c7b0800916c12a17b2f2b64010b2ef509

        SHA512

        dec42c080298452524d660f26dabb4444c02d5f2037ec2e72b8f18d021733203e1bd12eded656d5b29b40b999e020b7f34e1593e3fc1ff8de5809a7daa68374f

        Download Submit
      • memory/364-177-0x0000000000000000-mapping.dmp
        Download
      • memory/364-180-0x0000000180000000-0x0000000180009000-memory.dmp
        Filesize

        36KB

        Download
      • memory/2936-174-0x0000000000000000-mapping.dmp
        Download
      • memory/4104-172-0x0000000000000000-mapping.dmp
        Download
      • memory/4448-122-0x000001EE54730000-0x000001EE54752000-memory.dmp
        Filesize

        136KB

        Download
      • memory/4448-142-0x000001EE54CD0000-0x000001EE54D0C000-memory.dmp
        Filesize

        240KB

        Download
      • memory/4448-153-0x000001EE54D90000-0x000001EE54E06000-memory.dmp
        Filesize

        472KB

        Download
      • memory/4540-175-0x0000000000000000-mapping.dmp
        Download
      • memory/4684-176-0x0000000000000000-mapping.dmp
        Download