icedid | 94fe6a00f211ad9627153783f57b7828675e0e11979cbf16ceb26dcf966c937c

Analysis

max time kernel
126s
max time network
130s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12-12-2022 16:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Scan_Dec12.lnk
Size

2KB
MD5

3bed3aba524f00e21b67ddf6f61eff94
SHA1

45bf85cb17992e2d7f572c29275a4e41a9815634
SHA256

432544da261f7fd918fe9db502679075b6efcb81467742c409c34b1ce1648dd6
SHA512

65b43ce4d63611607a69a2e9dc0ff815fc1c5a1dfd5dccf0cca463f6a33df23f309d3d91e9197688efd50d70b44fab4ca9b6183fed8ec536a9f10a8dca25cbfe

Score

10^/10

icedid 814709416 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

814709416

ewgahskoot.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

2 1792 rundll32.exe
4 1792 rundll32.exe
5 1792 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1792 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1792 rundll32.exe
1792 rundll32.exe

flow	pid	process
2	1792	rundll32.exe
4	1792	rundll32.exe
5	1792	rundll32.exe

pid	process
1792	rundll32.exe

pid	process
1792	rundll32.exe
1792	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

cmd.execmd.exe

description	pid	process	target process
PID 1672 wrote to memory of 888	1672	cmd.exe	cmd.exe
PID 1672 wrote to memory of 888	1672	cmd.exe	cmd.exe
PID 1672 wrote to memory of 888	1672	cmd.exe	cmd.exe
PID 888 wrote to memory of 320	888	cmd.exe	xcopy.exe
PID 888 wrote to memory of 320	888	cmd.exe	xcopy.exe
PID 888 wrote to memory of 320	888	cmd.exe	xcopy.exe
PID 888 wrote to memory of 1792	888	cmd.exe	rundll32.exe
PID 888 wrote to memory of 1792	888	cmd.exe	rundll32.exe
PID 888 wrote to memory of 1792	888	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Scan_Dec12.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c ragaxe\codXl.cmd YXCX
2⤵
- Suspicious use of WriteProcessMemory
PID:888

C:\Windows\system32\xcopy.exe
xcopy /s /i /e /h ragaxe\offscouring.bin C:\Users\Admin\AppData\Local\Temp\*
3⤵
PID:320

C:\Windows\system32\rundll32.exe
rundll32 C:\Users\Admin\AppData\Local\Temp\offscouring.bin,init
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1792

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\offscouring.bin
Filesize
823KB

MD5
faa496bdd79e0ed4d4def753d2232bb8

SHA1
195dcacfb7d9a25585667e8ebdb5cd9926ffe069

SHA256
5c4061ed08f89eaa12f61842bc2bef83d29a2727a9dcff5d445d6b2fd120cae9

SHA512
0d57b824d0ac13d27e644465734cccbae50d3280dd00ab525fd4a9a965cc783e7e638960ec3f69ef31de51504f67bd4b810d0efb84808afac90d5013779bee34

Download Submit
\Users\Admin\AppData\Local\Temp\offscouring.bin
Filesize
823KB

MD5
faa496bdd79e0ed4d4def753d2232bb8

SHA1
195dcacfb7d9a25585667e8ebdb5cd9926ffe069

SHA256
5c4061ed08f89eaa12f61842bc2bef83d29a2727a9dcff5d445d6b2fd120cae9

SHA512
0d57b824d0ac13d27e644465734cccbae50d3280dd00ab525fd4a9a965cc783e7e638960ec3f69ef31de51504f67bd4b810d0efb84808afac90d5013779bee34

Download Submit
memory/320-89-0x0000000000000000-mapping.dmp

Download
memory/888-88-0x0000000000000000-mapping.dmp

Download
memory/1672-54-0x000007FEFBC01000-0x000007FEFBC03000-memory.dmp

Filesize
8KB

Download
memory/1792-93-0x0000000000000000-mapping.dmp

Download
memory/1792-96-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download