Analysis

  • max time kernel
    142s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    26/09/2022, 17:38

General

  • Target

    iowatelecom,document,09.26.2022.docm

  • Size

    865KB

  • MD5

    54099e7be024c3faff908fcffb6ca6cb

  • SHA1

    de5e212c5345b57fb61f0981767f222587c71483

  • SHA256

    5cc55537a511195f7156af0e5ba37f4b02c124e2e2576561a50efbb23c7e1ed6

  • SHA512

    76993fcc0d9877845efb0d0bbfc6d4b7cef20e0eece4d0d2b15fa181de5dab340f5526be09eb6708113918e786760ebf51a75b81d1cf909e79fca991eecdd517

  • SSDEEP

    12288:AVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEHhI+FG9RFt6eGc2rh3XDRe:AV2jUeQRI5wPN/2I+Fint6RdRe

Malware Config

Extracted

Family

icedid

Campaign

742081363

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\iowatelecom,document,09.26.2022.docm"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32 C:\ProgramData\57384994.87v,PluginInit
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1152
      • C:\Windows\system32\rundll32.exe
        rundll32 C:\ProgramData\57384994.87v,PluginInit
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:520
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1124

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\57384994.87v

      Filesize

      532KB

      MD5

      038efea1c2db1ae579f091311504b9c8

      SHA1

      1a2ac71de50821da93268266502cfba5dcf870a7

      SHA256

      2627b62eed570b7164ab2519bc92f300bdab7d7e57163e86556f7f46b03f3bf5

      SHA512

      692a4c6121c7442c09a00fae2038a5f356d3e197a463bcb45fbe33c8461b2e446b504e9fd9b895b0f4dda8fcc1e96ba4eeaf6af934b169da59d77e83602e906f

    • \ProgramData\57384994.87v

      Filesize

      532KB

      MD5

      038efea1c2db1ae579f091311504b9c8

      SHA1

      1a2ac71de50821da93268266502cfba5dcf870a7

      SHA256

      2627b62eed570b7164ab2519bc92f300bdab7d7e57163e86556f7f46b03f3bf5

      SHA512

      692a4c6121c7442c09a00fae2038a5f356d3e197a463bcb45fbe33c8461b2e446b504e9fd9b895b0f4dda8fcc1e96ba4eeaf6af934b169da59d77e83602e906f

    • \ProgramData\57384994.87v

      Filesize

      532KB

      MD5

      038efea1c2db1ae579f091311504b9c8

      SHA1

      1a2ac71de50821da93268266502cfba5dcf870a7

      SHA256

      2627b62eed570b7164ab2519bc92f300bdab7d7e57163e86556f7f46b03f3bf5

      SHA512

      692a4c6121c7442c09a00fae2038a5f356d3e197a463bcb45fbe33c8461b2e446b504e9fd9b895b0f4dda8fcc1e96ba4eeaf6af934b169da59d77e83602e906f

    • memory/520-239-0x0000000000120000-0x0000000000126000-memory.dmp

      Filesize

      24KB

    • memory/1964-84-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-92-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-58-0x000000007139D000-0x00000000713A8000-memory.dmp

      Filesize

      44KB

    • memory/1964-59-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-60-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-61-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-62-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-63-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-64-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-65-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-66-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-67-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-68-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-69-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-70-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-72-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-71-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-89-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-74-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-79-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-78-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-77-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-76-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-75-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-80-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-81-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-83-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-82-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-85-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1964-86-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-87-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-57-0x0000000076411000-0x0000000076413000-memory.dmp

      Filesize

      8KB

    • memory/1964-88-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-73-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-91-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-90-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-93-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-94-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-96-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-95-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-97-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-98-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-100-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-99-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-101-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-102-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-103-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-104-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-105-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-106-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-107-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-108-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-109-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-111-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-110-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-112-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-114-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-55-0x00000000703B1000-0x00000000703B3000-memory.dmp

      Filesize

      8KB

    • memory/1964-54-0x0000000072931000-0x0000000072934000-memory.dmp

      Filesize

      12KB

    • memory/1964-113-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-115-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-116-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-118-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-117-0x0000000000840000-0x0000000000844000-memory.dmp

      Filesize

      16KB

    • memory/1964-242-0x000000007139D000-0x00000000713A8000-memory.dmp

      Filesize

      44KB

    • memory/1964-244-0x000000007139D000-0x00000000713A8000-memory.dmp

      Filesize

      44KB