icedid | 5cc55537a511195f7156af0e5ba37f4b02c124e2e2576561a50efbb23c7e1ed6

General

Target

iowatelecom,document,09.26.2022.docm
Size

865KB
MD5

54099e7be024c3faff908fcffb6ca6cb
SHA1

de5e212c5345b57fb61f0981767f222587c71483
SHA256

5cc55537a511195f7156af0e5ba37f4b02c124e2e2576561a50efbb23c7e1ed6
SHA512

76993fcc0d9877845efb0d0bbfc6d4b7cef20e0eece4d0d2b15fa181de5dab340f5526be09eb6708113918e786760ebf51a75b81d1cf909e79fca991eecdd517
SSDEEP

12288:AVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEHhI+FG9RFt6eGc2rh3XDRe:AV2jUeQRI5wPN/2I+Fint6RdRe

Score

10^/10

icedid 742081363 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

742081363

C2

scainznorka.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	4960	1800	rundll32.exe	36

Blocklisted process makes network request 3 IoCs

flow	pid	Process
32	4960	rundll32.exe
50	4960	rundll32.exe
52	4960	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
4960	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1800	WINWORD.EXE
1800	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4960	rundll32.exe
4960	rundll32.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1800	WINWORD.EXE
1800	WINWORD.EXE
1800	WINWORD.EXE
1800	WINWORD.EXE
1800	WINWORD.EXE
1800	WINWORD.EXE
1800	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 4960	1800	WINWORD.EXE	86
PID 1800 wrote to memory of 4960	1800	WINWORD.EXE	86

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\iowatelecom,document,09.26.2022.docm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SYSTEM32\rundll32.exe
  rundll32 C:\ProgramData\795a611q.q47,PluginInit
  2⤵
  - Process spawned unexpected child process
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\795a611q.q47

Filesize
532KB

MD5
038efea1c2db1ae579f091311504b9c8

SHA1
1a2ac71de50821da93268266502cfba5dcf870a7

SHA256
2627b62eed570b7164ab2519bc92f300bdab7d7e57163e86556f7f46b03f3bf5

SHA512
692a4c6121c7442c09a00fae2038a5f356d3e197a463bcb45fbe33c8461b2e446b504e9fd9b895b0f4dda8fcc1e96ba4eeaf6af934b169da59d77e83602e906f

Download Submit
C:\ProgramData\795a611q.q47

Filesize
532KB

MD5
038efea1c2db1ae579f091311504b9c8

SHA1
1a2ac71de50821da93268266502cfba5dcf870a7

SHA256
2627b62eed570b7164ab2519bc92f300bdab7d7e57163e86556f7f46b03f3bf5

SHA512
692a4c6121c7442c09a00fae2038a5f356d3e197a463bcb45fbe33c8461b2e446b504e9fd9b895b0f4dda8fcc1e96ba4eeaf6af934b169da59d77e83602e906f

Download Submit
memory/1800-138-0x00007FFD531B0000-0x00007FFD531C0000-memory.dmp

Filesize
64KB

Download
memory/1800-140-0x000001A6F866E000-0x000001A6F873F000-memory.dmp

Filesize
836KB

Download
memory/1800-136-0x00007FFD55B10000-0x00007FFD55B20000-memory.dmp

Filesize
64KB

Download
memory/1800-137-0x00007FFD531B0000-0x00007FFD531C0000-memory.dmp

Filesize
64KB

Download
memory/1800-132-0x00007FFD55B10000-0x00007FFD55B20000-memory.dmp

Filesize
64KB

Download
memory/1800-139-0x000001A6F866E000-0x000001A6F873F000-memory.dmp

Filesize
836KB

Download
memory/1800-145-0x000001A6F866E000-0x000001A6F873F000-memory.dmp

Filesize
836KB

Download
memory/1800-141-0x000001A6F866E000-0x000001A6F873F000-memory.dmp

Filesize
836KB

Download
memory/1800-142-0x000001A6F866E000-0x000001A6F873F000-memory.dmp

Filesize
836KB

Download
memory/1800-143-0x000001A6F866E000-0x000001A6F873F000-memory.dmp

Filesize
836KB

Download
memory/1800-135-0x00007FFD55B10000-0x00007FFD55B20000-memory.dmp

Filesize
64KB

Download
memory/1800-144-0x000001A6F866E000-0x000001A6F873F000-memory.dmp

Filesize
836KB

Download
memory/1800-134-0x00007FFD55B10000-0x00007FFD55B20000-memory.dmp

Filesize
64KB

Download
memory/1800-147-0x000001A6F866E000-0x000001A6F873F000-memory.dmp

Filesize
836KB

Download
memory/1800-148-0x000001A6F866E000-0x000001A6F873F000-memory.dmp

Filesize
836KB

Download
memory/1800-163-0x00007FFD55B10000-0x00007FFD55B20000-memory.dmp

Filesize
64KB

Download
memory/1800-146-0x000001A6F866E000-0x000001A6F873F000-memory.dmp

Filesize
836KB

Download
memory/1800-133-0x00007FFD55B10000-0x00007FFD55B20000-memory.dmp

Filesize
64KB

Download
memory/1800-162-0x00007FFD55B10000-0x00007FFD55B20000-memory.dmp

Filesize
64KB

Download
memory/1800-161-0x00007FFD55B10000-0x00007FFD55B20000-memory.dmp

Filesize
64KB

Download
memory/1800-160-0x00007FFD55B10000-0x00007FFD55B20000-memory.dmp

Filesize
64KB

Download
memory/4960-158-0x0000026F70910000-0x0000026F70916000-memory.dmp

Filesize
24KB

Download
memory/4960-152-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads