icedid | 05289fdf2a8453e355040550b55a85aaff066dfd3e4fe9ff8558c54e6a12071f

Analysis

max time kernel
122s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 06:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
facts.lnk
Size 1KB
Sample221019-g67c8afebm
SHA256 4cb696f6a50cb2b73bf9a4d68f41a44d3c2486cd3fae518179aaaf69f5746ed9
MD5 28c829d86eeebda80fbb7a80919ee805
SHA1 b9f70882720987e2d00d7c6ef681908d208787e4
SHA512 4830586a8706779dc366202c3c62b2b7055c94876f29b592ccbc200c42cfb80c6f5dcec2af7819c9f1b26318b48945bfc09c8705884ad833cc76bb08468e374f
MD5 SHA1 SHA512

Score

10^/10

icedid 2959887884 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

2959887884

salimjizita.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Executes dropped EXE 1 IoCs

pid	Process
1816	go.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1816	go.exe
1816	go.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 4588	5108	cmd.exe	85
PID 5108 wrote to memory of 4588	5108	cmd.exe	85
PID 4588 wrote to memory of 1816	4588	cmd.exe	86
PID 4588 wrote to memory of 1816	4588	cmd.exe	86

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\facts.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mountaineers\sold.cmd ndll32.exe system windows
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Users\Admin\AppData\Local\Temp\go.exe
    C:\Users\Admin\AppData\Local\Temp\go.exe mountaineers\amidst.des,#1
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

go.exe

Path C:\Users\Admin\AppData\Local\Temp\go.exe
Size 70KB
SHA256 b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa
MD5 ef3179d498793bf4234f708d3be28633
SHA1 dd399ae46303343f9f0da189aee11c67bd868222
SHA512 02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e
SSDEEP 1536:J8qpnO/qRUNReI3fu6Uw2mTARPw2cm+YRQln5IUmDjoX:C/YUNRBfukTreXRQln5I
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1816-135-0x0000000180000000-0x0000000180009000-memory.dmp

Download

memory/1816-141-0x000001EEEE080000-0x000001EEEE086000-memory.dmp

Download