icedid | f21f2c15e99a4701452813233b3b5b8a20caf54e6185bf25d4dc733b12eb6426

General

Target

koppdesign.invoice.09.26.2022.docm
Size

867KB
MD5

b60773f08e36964d7613ec7e24e7f11a
SHA1

9ff60d3f1100b7d368b7f72d0b7c56cd7afd3cb3
SHA256

f21f2c15e99a4701452813233b3b5b8a20caf54e6185bf25d4dc733b12eb6426
SHA512

268c531320ac82968c62d915ba6c0da201905623d77fc82d0ffd2e43693dfa828302def2ffc3b710369326eed97dd0bdb0a33289d81bac05c78573f60bf9bd75
SSDEEP

12288:lgVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DE28huuV+/3P6OOssaxso:mV2jUeQRI5wPN/DYVV+6sNT

Score

10^/10

icedid 742081363 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

742081363

C2

scainznorka.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	4508	4980	rundll32.exe	WINWORD.EXE

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

42 4508 rundll32.exe
53 4508 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4508 rundll32.exe

flow	pid	process
42	4508	rundll32.exe
53	4508	rundll32.exe

pid	process
4508	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

4980 WINWORD.EXE
4980 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

4508 rundll32.exe
4508 rundll32.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

4980 WINWORD.EXE
4980 WINWORD.EXE
4980 WINWORD.EXE
4980 WINWORD.EXE
4980 WINWORD.EXE
4980 WINWORD.EXE
4980 WINWORD.EXE

pid	process
4980	WINWORD.EXE
4980	WINWORD.EXE

pid	process
4508	rundll32.exe
4508	rundll32.exe

pid	process
4980	WINWORD.EXE
4980	WINWORD.EXE
4980	WINWORD.EXE
4980	WINWORD.EXE
4980	WINWORD.EXE
4980	WINWORD.EXE
4980	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 4980 wrote to memory of 4508	4980	WINWORD.EXE	rundll32.exe
PID 4980 wrote to memory of 4508	4980	WINWORD.EXE	rundll32.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\koppdesign.invoice.09.26.2022.docm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4980

C:\Windows\SYSTEM32\rundll32.exe
rundll32 C:\ProgramData\6849p005.5i6,PluginInit
2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\6849p005.5i6
Filesize
532KB

MD5
e437222fb0414eb9dea9f1ee3bbac3c1

SHA1
ffead7a6ee9a73c90704463de34e26d169265f4d

SHA256
c02c1ac4876919555c4c79684d8169c6ca3b1f3be6be1949166882d380a2fcbb

SHA512
441e317964e1e13ad1a4458bdfb83e42a521e4c485673a81f4d3fa48f979631f3d54c2feb9290329a5330f2c7df4681bb1b766449238c6c0f69f6e88f7da32be

Download Submit
C:\ProgramData\6849p005.5i6
Filesize
532KB

MD5
e437222fb0414eb9dea9f1ee3bbac3c1

SHA1
ffead7a6ee9a73c90704463de34e26d169265f4d

SHA256
c02c1ac4876919555c4c79684d8169c6ca3b1f3be6be1949166882d380a2fcbb

SHA512
441e317964e1e13ad1a4458bdfb83e42a521e4c485673a81f4d3fa48f979631f3d54c2feb9290329a5330f2c7df4681bb1b766449238c6c0f69f6e88f7da32be

Download Submit
memory/4508-139-0x0000000000000000-mapping.dmp

Download
memory/4508-142-0x0000015147A10000-0x0000015147A16000-memory.dmp

Filesize
24KB

Download
memory/4508-143-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/4980-136-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Filesize
64KB

Download
memory/4980-138-0x00007FFA94040000-0x00007FFA94050000-memory.dmp

Filesize
64KB

Download
memory/4980-137-0x00007FFA94040000-0x00007FFA94050000-memory.dmp

Filesize
64KB

Download
memory/4980-132-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Filesize
64KB

Download
memory/4980-135-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Filesize
64KB

Download
memory/4980-134-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Filesize
64KB

Download
memory/4980-133-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Filesize
64KB

Download
memory/4980-150-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Filesize
64KB

Download
memory/4980-151-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Filesize
64KB

Download
memory/4980-152-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Filesize
64KB

Download
memory/4980-153-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads