icedid | 5bed7aa2d24f217abcbcef9ba69ea7eac2b58d2bf3921e845934c65efb7fd251

General

Target

ironivyinc document 09.26.docm
Size

865KB
MD5

ee89b0b3d4269bfdcceb595c733a7243
SHA1

9771c886ebe2f1d2b5b0100b3fb43cff334ba9ce
SHA256

5bed7aa2d24f217abcbcef9ba69ea7eac2b58d2bf3921e845934c65efb7fd251
SHA512

b67f16b95bdc4a366df522fb58dd08714d010e27f4fbfd57d04753ae1573b011e6567ed61822a50109d6f006f789f5f0c400650efb569d370729a5b7fcae15ee
SSDEEP

12288:2eSGVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DES7AI/xKToQM3XD4:2eSGV2jUeQRI5wPN/zAI94

Score

10^/10

icedid 742081363 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

742081363

C2

scainznorka.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	1644	2476	rundll32.exe	WINWORD.EXE

Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

35 1644 rundll32.exe
54 1644 rundll32.exe
61 1644 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1644 rundll32.exe

flow	pid	process
35	1644	rundll32.exe
54	1644	rundll32.exe
61	1644	rundll32.exe

pid	process
1644	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

2476 WINWORD.EXE
2476 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1644 rundll32.exe
1644 rundll32.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

2476 WINWORD.EXE
2476 WINWORD.EXE
2476 WINWORD.EXE
2476 WINWORD.EXE
2476 WINWORD.EXE
2476 WINWORD.EXE
2476 WINWORD.EXE

pid	process
2476	WINWORD.EXE
2476	WINWORD.EXE

pid	process
1644	rundll32.exe
1644	rundll32.exe

pid	process
2476	WINWORD.EXE
2476	WINWORD.EXE
2476	WINWORD.EXE
2476	WINWORD.EXE
2476	WINWORD.EXE
2476	WINWORD.EXE
2476	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 2476 wrote to memory of 1644	2476	WINWORD.EXE	rundll32.exe
PID 2476 wrote to memory of 1644	2476	WINWORD.EXE	rundll32.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ironivyinc document 09.26.docm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476

C:\Windows\SYSTEM32\rundll32.exe
rundll32 C:\ProgramData\7950r116.6l7,PluginInit
2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\7950r116.6l7
Filesize
532KB

MD5
b6a1213571b0ebcb6259a9d50abc1e63

SHA1
3e9fbc4d1e6fa25d5f78e0d04445ac43212de231

SHA256
49fe14b176055d6f2890182ae7b1a3c5453d9286e72187192d738da947dc1646

SHA512
a76b5bdb0146e3185184a87d86b9c96fd59b6e20a7533d0b63904d60dd4db11a24a745f8a4389306a3c92d7bc4c28adc31463aa542f0caa47c10a6497264cca4

Download Submit
C:\ProgramData\7950r116.6l7
Filesize
532KB

MD5
b6a1213571b0ebcb6259a9d50abc1e63

SHA1
3e9fbc4d1e6fa25d5f78e0d04445ac43212de231

SHA256
49fe14b176055d6f2890182ae7b1a3c5453d9286e72187192d738da947dc1646

SHA512
a76b5bdb0146e3185184a87d86b9c96fd59b6e20a7533d0b63904d60dd4db11a24a745f8a4389306a3c92d7bc4c28adc31463aa542f0caa47c10a6497264cca4

Download Submit
memory/1644-139-0x0000000000000000-mapping.dmp

Download
memory/1644-148-0x0000022234D80000-0x0000022234D86000-memory.dmp

Filesize
24KB

Download
memory/1644-142-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/2476-136-0x00007FFB70CF0000-0x00007FFB70D00000-memory.dmp

Filesize
64KB

Download
memory/2476-138-0x00007FFB6E6B0000-0x00007FFB6E6C0000-memory.dmp

Filesize
64KB

Download
memory/2476-137-0x00007FFB6E6B0000-0x00007FFB6E6C0000-memory.dmp

Filesize
64KB

Download
memory/2476-132-0x00007FFB70CF0000-0x00007FFB70D00000-memory.dmp

Filesize
64KB

Download
memory/2476-135-0x00007FFB70CF0000-0x00007FFB70D00000-memory.dmp

Filesize
64KB

Download
memory/2476-134-0x00007FFB70CF0000-0x00007FFB70D00000-memory.dmp

Filesize
64KB

Download
memory/2476-133-0x00007FFB70CF0000-0x00007FFB70D00000-memory.dmp

Filesize
64KB

Download
memory/2476-150-0x00007FFB70CF0000-0x00007FFB70D00000-memory.dmp

Filesize
64KB

Download
memory/2476-153-0x00007FFB70CF0000-0x00007FFB70D00000-memory.dmp

Filesize
64KB

Download
memory/2476-152-0x00007FFB70CF0000-0x00007FFB70D00000-memory.dmp

Filesize
64KB

Download
memory/2476-151-0x00007FFB70CF0000-0x00007FFB70D00000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads