Overview

overview

10

Static

static

Setup_Win_...29.msi

windows7-x64

10

Setup_Win_...29.msi

windows10-1703-x64

10

Analysis

  • max time kernel
    1786s
  • max time network
    1790s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    19-12-2022 13:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Setup_Win_14-12-2022_18-36-29.msi

  • Size

    1.9MB

  • MD5

    483a92951b440f2212fbfba38174d8a4

  • SHA1

    914b9a827b1937935681a033b1c32a2df97a4874

  • SHA256

    63a7d98369925d6e98994cdb5937bd896506665be9f80dc55de7eb6df00f7607

  • SHA512

    336d65a516d8503ec939cb52d186b42d1dc41abc253ac85262bd251f4c63f81fa78d8f48122e608c91ec7f6cf43db1daf87c9c26f6636fa6410d10541018a93b

  • SSDEEP

    49152:Jr0QHD5a4/7yGe8EsuRMEl73hXNGzchfzYZppUQ:Jr08MuLshh

Score
10/10
icedid1002085315bankerloadertrojan

Malware Config

Extracted

Family

icedid

Campaign

1002085315

C2

klepdrafooip.com

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • Blocklisted process makes network request 30 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Setup_Win_14-12-2022_18-36-29.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2484
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3352
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4924
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 8AC8D1EC7583A172AD2C62D676632653
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4360
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIAE0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240585625 2 test.cs!XXX.YyY.ZzZ
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:4452
          • C:\Windows\System32\rundll32.exe
            "C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\MSIc07fc405.mst",init
            4⤵
            • Blocklisted process makes network request
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:2964
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1848
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
      1⤵
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:1448

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    Peripheral Device Discovery

    2
    T1120

    System Information Discovery

    3
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\MSIc07fc405.mst
      Filesize

      1.4MB

      MD5

      ddc204b27174d22b5bbf10819bf30707

      SHA1

      c70473bc99e2fec21c1bc305a1f81ea3d52aaed0

      SHA256

      7e5da5fcda0da494da85cdc76384b3b08f135f09f20e582e049486e8ae2f168e

      SHA512

      8f3c9a8ec15458b2302a1914fc8408c156a88b872982122c2171c7290679e14f51268b1f5c405143322e99c71e7eb7ff24f1c4492f01ce76ecdbe965fb880adf

      Download Submit
    • C:\Windows\Installer\MSIAE0.tmp
      Filesize

      414KB

      MD5

      cda2f0bb7819921c98e376562f8db1bb

      SHA1

      1a579a1b47c840a85181da8a70fe846084cd83c2

      SHA256

      3294ddfeba71b6718034400e2c40dc1f8f64f2480aff90c38e6b04a9fc2cb1ad

      SHA512

      9058543415ff917dbcf583c1bb99ba41142d3f22617fe3e409a7cf219d9f32ca8d11130e4e7df93025d0e332efd5ba71d54a3d88f9eec4b98e4f2fea9743a2ad

      Download Submit
    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
      Filesize

      25.0MB

      MD5

      f240871ff7ace91231cd65d5c90fc356

      SHA1

      ef9e46c87dae843c2106b063c5cd536483bec3d6

      SHA256

      cf659a2d1881253fc4028a7263613713fed406dcb417e378d3d3ea9f2d5bbf31

      SHA512

      e4bd8f85eae956bc70a58f1bfeffc55ea9a17c25ad55ba00613641183a29770424bde4867d7d9893f377b4cb1fd2d49ebb657cd24ab715b9ff7f2bfca6603e52

      Download Submit
    • \??\Volume{b79df8d1-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{c0e2ae3a-d7ac-4c44-ada6-c308a602a905}_OnDiskSnapshotProp
      Filesize

      5KB

      MD5

      9b7a51bdeec8f5ddbcb8a5d89901dfb8

      SHA1

      9388487a1531a38b5da40aa9c3d7118bed015362

      SHA256

      b353e9425cd55dc7b13bc4a504e281da70d1bc3112010566a5b5645555ab3a8d

      SHA512

      c45d8db4297a56a68711b376732a8e2cec5d785663eeef5d4fcdff092de740042d34a3bf798873b336534e6bb3f6049db8721bc6d0abd9f64c0c4a404d2fffef

      Download Submit
    • \Users\Admin\AppData\Local\MSIc07fc405.mst
      Filesize

      1.4MB

      MD5

      ddc204b27174d22b5bbf10819bf30707

      SHA1

      c70473bc99e2fec21c1bc305a1f81ea3d52aaed0

      SHA256

      7e5da5fcda0da494da85cdc76384b3b08f135f09f20e582e049486e8ae2f168e

      SHA512

      8f3c9a8ec15458b2302a1914fc8408c156a88b872982122c2171c7290679e14f51268b1f5c405143322e99c71e7eb7ff24f1c4492f01ce76ecdbe965fb880adf

      Download Submit
    • \Windows\Installer\MSIAE0.tmp
      Filesize

      414KB

      MD5

      cda2f0bb7819921c98e376562f8db1bb

      SHA1

      1a579a1b47c840a85181da8a70fe846084cd83c2

      SHA256

      3294ddfeba71b6718034400e2c40dc1f8f64f2480aff90c38e6b04a9fc2cb1ad

      SHA512

      9058543415ff917dbcf583c1bb99ba41142d3f22617fe3e409a7cf219d9f32ca8d11130e4e7df93025d0e332efd5ba71d54a3d88f9eec4b98e4f2fea9743a2ad

      Download Submit
    • \Windows\Installer\MSIAE0.tmp
      Filesize

      414KB

      MD5

      cda2f0bb7819921c98e376562f8db1bb

      SHA1

      1a579a1b47c840a85181da8a70fe846084cd83c2

      SHA256

      3294ddfeba71b6718034400e2c40dc1f8f64f2480aff90c38e6b04a9fc2cb1ad

      SHA512

      9058543415ff917dbcf583c1bb99ba41142d3f22617fe3e409a7cf219d9f32ca8d11130e4e7df93025d0e332efd5ba71d54a3d88f9eec4b98e4f2fea9743a2ad

      Download Submit
    • memory/2964-150-0x0000025F157F0000-0x0000025F157F9000-memory.dmp
      Filesize

      36KB

      Download
    • memory/2964-145-0x0000000000000000-mapping.dmp
      Download
    • memory/4360-125-0x0000000000000000-mapping.dmp
      Download
    • memory/4452-130-0x0000000000000000-mapping.dmp
      Download
    • memory/4452-140-0x00000220C2090000-0x00000220C2100000-memory.dmp
      Filesize

      448KB

      Download
    • memory/4452-139-0x00000220A9AC0000-0x00000220A9ACA000-memory.dmp
      Filesize

      40KB

      Download
    • memory/4452-135-0x00000220A9AE0000-0x00000220A9B0E000-memory.dmp
      Filesize

      184KB

      Download
    • memory/4924-124-0x0000000000000000-mapping.dmp
      Download