icedid | 3af042bd0b5a186b98920cf0b7066344609d6d6deb163ffb0b60325dcca66e44

General

Target

courtesyautomotivedoc08.11.docm
Size

2.2MB
MD5

00e8f42e0462d4abf8a6bb6960abe5b5
SHA1

0235d1eb73c161a7fcc944d99730d8ed0200fb8e
SHA256

3af042bd0b5a186b98920cf0b7066344609d6d6deb163ffb0b60325dcca66e44
SHA512

927b5d5c0a8230738b5e56d05f2b0c669c2a564ef013707cce466250ddddb6d779077e4a8ee75ed39bc4a6485cbf30b6ba6edc8f819b74fd3f400e6c84460f96

Score

10^/10

icedid 3570055661 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3570055661

C2

alexbionka.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

52 3956 rundll32.exe
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

r1CFA.tmp.exe

pid process

2380 r1CFA.tmp.exe
Loads dropped DLL 2 IoCs

Processes:

r1CFA.tmp.exerundll32.exe

pid process

2380 r1CFA.tmp.exe
3956 rundll32.exe

flow	pid	process
52	3956	rundll32.exe

pid	process
2380	r1CFA.tmp.exe

pid	process
2380	r1CFA.tmp.exe
3956	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

4864 WINWORD.EXE
4864 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

3956 rundll32.exe
3956 rundll32.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

4864 WINWORD.EXE
4864 WINWORD.EXE
4864 WINWORD.EXE
4864 WINWORD.EXE
4864 WINWORD.EXE
4864 WINWORD.EXE
4864 WINWORD.EXE

pid	process
4864	WINWORD.EXE
4864	WINWORD.EXE

pid	process
3956	rundll32.exe
3956	rundll32.exe

pid	process
4864	WINWORD.EXE
4864	WINWORD.EXE
4864	WINWORD.EXE
4864	WINWORD.EXE
4864	WINWORD.EXE
4864	WINWORD.EXE
4864	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

WINWORD.EXEr1CFA.tmp.exe

description	pid	process	target process
PID 4864 wrote to memory of 2380	4864	WINWORD.EXE	r1CFA.tmp.exe
PID 4864 wrote to memory of 2380	4864	WINWORD.EXE	r1CFA.tmp.exe
PID 4864 wrote to memory of 2380	4864	WINWORD.EXE	r1CFA.tmp.exe
PID 2380 wrote to memory of 3956	2380	r1CFA.tmp.exe	rundll32.exe
PID 2380 wrote to memory of 3956	2380	r1CFA.tmp.exe	rundll32.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\courtesyautomotivedoc08.11.docm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864

C:\Users\Admin\AppData\Local\Temp\r1CFA.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\r1CFA.tmp.exe" "C:\Users\Admin\AppData\Local\Temp\yB65.tmp.dll",#1
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380

C:\Windows\system32\rundll32.exe
"C:\Users\Admin\AppData\Local\Temp\r1CFA.tmp.exe" "C:\Users\Admin\AppData\Local\Temp\yB65.tmp.dll",#1
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3956

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\r1CFA.tmp.exe
Filesize
60KB

MD5
889b99c52a60dd49227c5e485a016679

SHA1
8fa889e456aa646a4d0a4349977430ce5fa5e2d7

SHA256
6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

SHA512
08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

Download Submit
C:\Users\Admin\AppData\Local\Temp\yB65.tmp.dll
Filesize
352KB

MD5
462b3693b0d031a3c11f35ea49f8f917

SHA1
a72ffbfc510b51664182fc548dc0ac5ec7693335

SHA256
0341825bbb5afc42fbcb1b19fa5ec3b3c7113a0a339c52bd7743cb5be49ca7a9

SHA512
c3254c0e181b9d6e0ad8f22214556afad31a3e4d5a1a6533df0bc3647b47efcaa681f0d029f03add43f11ececbc836802af0d47b52ba520f57c465d8060bdd35

Download Submit
C:\Users\Admin\AppData\Local\Temp\yB65.tmp.dll
Filesize
352KB

MD5
462b3693b0d031a3c11f35ea49f8f917

SHA1
a72ffbfc510b51664182fc548dc0ac5ec7693335

SHA256
0341825bbb5afc42fbcb1b19fa5ec3b3c7113a0a339c52bd7743cb5be49ca7a9

SHA512
c3254c0e181b9d6e0ad8f22214556afad31a3e4d5a1a6533df0bc3647b47efcaa681f0d029f03add43f11ececbc836802af0d47b52ba520f57c465d8060bdd35

Download Submit
C:\Users\Admin\AppData\Local\Temp\yB65.tmp.dll
Filesize
352KB

MD5
462b3693b0d031a3c11f35ea49f8f917

SHA1
a72ffbfc510b51664182fc548dc0ac5ec7693335

SHA256
0341825bbb5afc42fbcb1b19fa5ec3b3c7113a0a339c52bd7743cb5be49ca7a9

SHA512
c3254c0e181b9d6e0ad8f22214556afad31a3e4d5a1a6533df0bc3647b47efcaa681f0d029f03add43f11ececbc836802af0d47b52ba520f57c465d8060bdd35

Download Submit
memory/2380-146-0x0000000000000000-mapping.dmp

Download
memory/3956-155-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/3956-150-0x0000000000000000-mapping.dmp

Download
memory/4864-140-0x00007FFCC1740000-0x00007FFCC1750000-memory.dmp

Filesize
64KB

Download
memory/4864-139-0x00007FFCC38D0000-0x00007FFCC38E0000-memory.dmp

Filesize
64KB

Download
memory/4864-144-0x000001D04D56A000-0x000001D04D74D000-memory.dmp

Filesize
1.9MB

Download
memory/4864-145-0x000001D04D190000-0x000001D04D286000-memory.dmp

Filesize
984KB

Download
memory/4864-142-0x000001D048523000-0x000001D048525000-memory.dmp

Filesize
8KB

Download
memory/4864-141-0x00007FFCC1740000-0x00007FFCC1750000-memory.dmp

Filesize
64KB

Download
memory/4864-135-0x00007FFCC38D0000-0x00007FFCC38E0000-memory.dmp

Filesize
64KB

Download
memory/4864-143-0x000001D048523000-0x000001D048525000-memory.dmp

Filesize
8KB

Download
memory/4864-138-0x00007FFCC38D0000-0x00007FFCC38E0000-memory.dmp

Filesize
64KB

Download
memory/4864-136-0x00007FFCC38D0000-0x00007FFCC38E0000-memory.dmp

Filesize
64KB

Download
memory/4864-152-0x000001D048523000-0x000001D048525000-memory.dmp

Filesize
8KB

Download
memory/4864-153-0x000001D048523000-0x000001D048525000-memory.dmp

Filesize
8KB

Download
memory/4864-154-0x000001D04D190000-0x000001D04D286000-memory.dmp

Filesize
984KB

Download
memory/4864-137-0x00007FFCC38D0000-0x00007FFCC38E0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads