icedid | 05289fdf2a8453e355040550b55a85aaff066dfd3e4fe9ff8558c54e6a12071f

Analysis

max time kernel
125s
max time network
129s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 06:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
facts.lnk
Size 1KB
Sample221019-g67c8afebm
SHA256 4cb696f6a50cb2b73bf9a4d68f41a44d3c2486cd3fae518179aaaf69f5746ed9
MD5 28c829d86eeebda80fbb7a80919ee805
SHA1 b9f70882720987e2d00d7c6ef681908d208787e4
SHA512 4830586a8706779dc366202c3c62b2b7055c94876f29b592ccbc200c42cfb80c6f5dcec2af7819c9f1b26318b48945bfc09c8705884ad833cc76bb08468e374f
MD5 SHA1 SHA512

Score

10^/10

icedid 2959887884 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

2959887884

salimjizita.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Executes dropped EXE 1 IoCs

pid	Process
2004	go.exe

Loads dropped DLL 1 IoCs

pid	Process
1112	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2004	go.exe
2004	go.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1112	1612	cmd.exe	27
PID 1612 wrote to memory of 1112	1612	cmd.exe	27
PID 1612 wrote to memory of 1112	1612	cmd.exe	27
PID 1112 wrote to memory of 2004	1112	cmd.exe	28
PID 1112 wrote to memory of 2004	1112	cmd.exe	28
PID 1112 wrote to memory of 2004	1112	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\facts.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mountaineers\sold.cmd ndll32.exe system windows
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Users\Admin\AppData\Local\Temp\go.exe
    C:\Users\Admin\AppData\Local\Temp\go.exe mountaineers\amidst.des,#1
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

go.exe

Path C:\Users\Admin\AppData\Local\Temp\go.exe
Size 44KB
SHA256 f5691b8f200e3196e6808e932630e862f8f26f31cd949981373f23c9d87db8b9
MD5 dd81d91ff3b0763c392422865c9ac12e
SHA1 963b55acc8c566876364716d5aafa353995812a8
SHA512 8a5036ccab9c9e71deb4ecb9598528ca19c2d697a836846d23e1547b24172fa236a798092c7db676929abff830e40f52ce8f3b3bdd8d4c2553d7c021fceaf120
SSDEEP 768:lC2UEwdMtWsxjR6l0eiJMVhbfMPURqbSEln5IyYpamDjobj8S:lkMtNoluMVdMPURqln5IUmDjoX
MD5 SHA1 SHA512 SSDEEP

Submit Download

go.exe

Path \Users\Admin\AppData\Local\Temp\go.exe
Size 44KB
SHA256 f5691b8f200e3196e6808e932630e862f8f26f31cd949981373f23c9d87db8b9
MD5 dd81d91ff3b0763c392422865c9ac12e
SHA1 963b55acc8c566876364716d5aafa353995812a8
SHA512 8a5036ccab9c9e71deb4ecb9598528ca19c2d697a836846d23e1547b24172fa236a798092c7db676929abff830e40f52ce8f3b3bdd8d4c2553d7c021fceaf120
SSDEEP 768:lC2UEwdMtWsxjR6l0eiJMVhbfMPURqbSEln5IyYpamDjobj8S:lkMtNoluMVdMPURqln5IUmDjoX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1612-54-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmp

Download

memory/2004-95-0x0000000180000000-0x0000000180009000-memory.dmp

Download

memory/2004-101-0x00000000000F0000-0x00000000000F6000-memory.dmp

Download