Overview

overview

10

Static

static

document_3_Oct31.iso

windows10-1703-x64

10

Analysis

  • max time kernel
    56s
  • max time network
    61s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15-11-2022 14:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    document_3_Oct31.iso

  • Size

    1.6MB

  • MD5

    3339890f086c12010a16cfe572cbb2b4

  • SHA1

    947d4242281b0853c8c473b16c83f97e4587d06f

  • SHA256

    043a13615bdfe7a7011f09b826a4a5f5597f8b8e4b9498c0807e67db9ad1ed88

  • SHA512

    ad9338a17605c3e21441751304f7608893792a4562be65f4c4bec812f2626af5ffc15d54287e4587314f10f52fd7e5bb37a3667959dc43d55429615449b56aa2

  • SSDEEP

    3072:2bK+nYMBh+aDMT7c5OdL6lxzs+M9EYr4gwsB/dNLB+hC:2bKYD+b5dyx904gRH+hC

Score
10/10
icedid533886235bankerloadertrojan

Malware Config

Extracted

Family

icedid

Campaign

533886235

C2

vgiragdoffy.com

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • Blocklisted process makes network request 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\document_3_Oct31.iso
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:4356
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
    1⤵
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:1676
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3860
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""E:\ribfaymasnot\chickenrelaxed.bat" "
      1⤵
      • Enumerates connected drives
      • Suspicious use of WriteProcessMemory
      PID:3388
      • C:\Windows\system32\xcopy.exe
        xcopy /s /i /e /h ribfaymasnot\shortening.dat C:\Users\Admin\AppData\Local\Temp\*
        2⤵
          PID:4600
        • C:\Windows\system32\rundll32.exe
          rundll32 C:\Users\Admin\AppData\Local\Temp\shortening.dat,#1
          2⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:4576

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\shortening.dat
        Filesize

        202KB

        MD5

        288886073fb9d234d79bbde4f009b29e

        SHA1

        4206f83e4e8e06819f55bfb8db09a6ef74f5ce5d

        SHA256

        2ff819c01e03fa26413bf607711df3e5a7f4efdffe55f57c3c637d6c7b408bec

        SHA512

        e9f7c7341da5b80f379111b65e9f075d4228a9d7c7754596b464c314b119e4010036af10d038b5891a4ce2668501f097ca68e041bd287818954730a03ab2cd4a

        Download Submit
      • \Users\Admin\AppData\Local\Temp\shortening.dat
        Filesize

        202KB

        MD5

        288886073fb9d234d79bbde4f009b29e

        SHA1

        4206f83e4e8e06819f55bfb8db09a6ef74f5ce5d

        SHA256

        2ff819c01e03fa26413bf607711df3e5a7f4efdffe55f57c3c637d6c7b408bec

        SHA512

        e9f7c7341da5b80f379111b65e9f075d4228a9d7c7754596b464c314b119e4010036af10d038b5891a4ce2668501f097ca68e041bd287818954730a03ab2cd4a

        Download Submit
      • memory/4576-116-0x0000000000000000-mapping.dmp
        Download
      • memory/4576-119-0x0000000180000000-0x0000000180009000-memory.dmp
        Filesize

        36KB

        Download
      • memory/4576-125-0x00000261711C0000-0x00000261711C6000-memory.dmp
        Filesize

        24KB

        Download
      • memory/4600-115-0x0000000000000000-mapping.dmp
        Download