icedid | d47334b943e152eef809da3d651880e1821749ad9ba2b2e08c9fd5a2db4a8e1c

General

Target

kingwoodcable-invoice-09.26.docm
Size

867KB
MD5

b77224a6c9eb4987077d0f7ec33af582
SHA1

311d8d1dfc90096ccd26db3922fe03fa3c0ced85
SHA256

d47334b943e152eef809da3d651880e1821749ad9ba2b2e08c9fd5a2db4a8e1c
SHA512

436abc2e96e07436acfa19753307e9bafc825b03d41a0399792af5c7d3832d75b317f1d103577e1edecbb31310bf065d5c169dfd72403dfe26c156c1940c4338
SSDEEP

12288:nGOVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEOesyErljCREMJyc5RU:nVV2jUeQRI5wPN/8krleREMJ0

Score

10^/10

icedid 742081363 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

742081363

C2

scainznorka.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	5032	1144	rundll32.exe	WINWORD.EXE

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

36 5032 rundll32.exe
52 5032 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

5032 rundll32.exe

flow	pid	process
36	5032	rundll32.exe
52	5032	rundll32.exe

pid	process
5032	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

1144 WINWORD.EXE
1144 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

5032 rundll32.exe
5032 rundll32.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

1144 WINWORD.EXE
1144 WINWORD.EXE
1144 WINWORD.EXE
1144 WINWORD.EXE
1144 WINWORD.EXE
1144 WINWORD.EXE
1144 WINWORD.EXE

pid	process
1144	WINWORD.EXE
1144	WINWORD.EXE

pid	process
5032	rundll32.exe
5032	rundll32.exe

pid	process
1144	WINWORD.EXE
1144	WINWORD.EXE
1144	WINWORD.EXE
1144	WINWORD.EXE
1144	WINWORD.EXE
1144	WINWORD.EXE
1144	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 1144 wrote to memory of 5032	1144	WINWORD.EXE	rundll32.exe
PID 1144 wrote to memory of 5032	1144	WINWORD.EXE	rundll32.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\kingwoodcable-invoice-09.26.docm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144

C:\Windows\SYSTEM32\rundll32.exe
rundll32 C:\ProgramData\13940550.081,PluginInit
2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5032

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\13940550.081
Filesize
532KB

MD5
9f9ee2c66b4d7183f5de44f1925fb13d

SHA1
84d1a2cb0de3c4f917a0f50595ffeb9269200a5a

SHA256
77554972921d8539d1f19a3955b9c27179489d7e54cbda4719e8a6543f8a3c86

SHA512
ea4e06de25ed75ce7123a90f3300a3998c9719cc5c568afaf0248756ce6ec3ed6ee3c8e311494be4b1b6aff905c5a2b4c1778b9c30f022864eb6603c08e193f8

Download Submit
C:\ProgramData\13940550.081
Filesize
532KB

MD5
9f9ee2c66b4d7183f5de44f1925fb13d

SHA1
84d1a2cb0de3c4f917a0f50595ffeb9269200a5a

SHA256
77554972921d8539d1f19a3955b9c27179489d7e54cbda4719e8a6543f8a3c86

SHA512
ea4e06de25ed75ce7123a90f3300a3998c9719cc5c568afaf0248756ce6ec3ed6ee3c8e311494be4b1b6aff905c5a2b4c1778b9c30f022864eb6603c08e193f8

Download Submit
memory/1144-135-0x00007FFF56550000-0x00007FFF56560000-memory.dmp

Filesize
64KB

Download
memory/1144-153-0x00007FFF56550000-0x00007FFF56560000-memory.dmp

Filesize
64KB

Download
memory/1144-136-0x00007FFF56550000-0x00007FFF56560000-memory.dmp

Filesize
64KB

Download
memory/1144-137-0x00007FFF53BF0000-0x00007FFF53C00000-memory.dmp

Filesize
64KB

Download
memory/1144-138-0x00007FFF53BF0000-0x00007FFF53C00000-memory.dmp

Filesize
64KB

Download
memory/1144-139-0x000001F1DA47D000-0x000001F1DA47F000-memory.dmp

Filesize
8KB

Download
memory/1144-132-0x00007FFF56550000-0x00007FFF56560000-memory.dmp

Filesize
64KB

Download
memory/1144-133-0x00007FFF56550000-0x00007FFF56560000-memory.dmp

Filesize
64KB

Download
memory/1144-134-0x00007FFF56550000-0x00007FFF56560000-memory.dmp

Filesize
64KB

Download
memory/1144-143-0x000001F1DA47D000-0x000001F1DA47F000-memory.dmp

Filesize
8KB

Download
memory/1144-155-0x00007FFF56550000-0x00007FFF56560000-memory.dmp

Filesize
64KB

Download
memory/1144-154-0x00007FFF56550000-0x00007FFF56560000-memory.dmp

Filesize
64KB

Download
memory/1144-152-0x00007FFF56550000-0x00007FFF56560000-memory.dmp

Filesize
64KB

Download
memory/5032-140-0x0000000000000000-mapping.dmp

Download
memory/5032-150-0x0000024067590000-0x0000024067596000-memory.dmp

Filesize
24KB

Download
memory/5032-144-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads