icedid | 97593b69833226ed1488e6914351418018094dcedbab0984eae4648e12d8b26b

General

Target

overcontrolling.dll
Size

1.6MB
MD5

1795382b21fad93fe3fe3d75ef40a67d
SHA1

7a6fa8a71a68e3226b6cad24cd3eff4767111e58
SHA256

97593b69833226ed1488e6914351418018094dcedbab0984eae4648e12d8b26b
SHA512

189ba19e3cbf8ca0dc02524e4d73eb53bb7408c9e451061373f797603a2ccd80d4de41756e0e896a29124d700f184279b2403a130eca0b1389f3d2aee5bad74f
SSDEEP

24576:XmJTd0nVi/Md3bupZkKBhWPRIlq5YZ6a2CXH7oZgKGc+erWJUVWyubuapwNDlaTI:XmJTd4iMwXH7oZgKb++BVL4B+NITgr0Y

Score

10^/10

icedid 3114391984 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3114391984

C2

estrabornhot.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

4 1744 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1972 1664 WerFault.exe rundll32.exe

flow	pid	process
4	1744	rundll32.exe

pid	pid_target	process	target process
1972	1664	WerFault.exe	rundll32.exe

Modifies data under HKEY_USERS 22 IoCs

Processes:

SearchIndexer.exeSearchProtocolHost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-304 = "Public Recorded TV"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\windows journal\journal.exe,-62005 = "Tablet PC"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} {0000013A-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000002712bbb714d901	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200005 = "Websites for United States"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-312 = "Sample Media"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1744 rundll32.exe
1744 rundll32.exe

pid	process
1744	rundll32.exe
1744	rundll32.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

AUDIODG.EXESearchIndexer.exe

description	pid	process
Token: 33	676	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	676	AUDIODG.EXE
Token: 33	676	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	676	AUDIODG.EXE
Token: SeManageVolumePrivilege	1528	SearchIndexer.exe
Token: 33	1528	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1528	SearchIndexer.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

SearchProtocolHost.exeSearchProtocolHost.exe

pid	process
1644	SearchProtocolHost.exe
1644	SearchProtocolHost.exe
1644	SearchProtocolHost.exe
1644	SearchProtocolHost.exe
1644	SearchProtocolHost.exe
1224	SearchProtocolHost.exe
1224	SearchProtocolHost.exe
1224	SearchProtocolHost.exe
1224	SearchProtocolHost.exe
1224	SearchProtocolHost.exe
1224	SearchProtocolHost.exe
1644	SearchProtocolHost.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

rundll32.exeSearchIndexer.execmd.exe

description	pid	process	target process
PID 1664 wrote to memory of 1972	1664	rundll32.exe	WerFault.exe
PID 1664 wrote to memory of 1972	1664	rundll32.exe	WerFault.exe
PID 1664 wrote to memory of 1972	1664	rundll32.exe	WerFault.exe
PID 1528 wrote to memory of 1644	1528	SearchIndexer.exe	SearchProtocolHost.exe
PID 1528 wrote to memory of 1644	1528	SearchIndexer.exe	SearchProtocolHost.exe
PID 1528 wrote to memory of 1644	1528	SearchIndexer.exe	SearchProtocolHost.exe
PID 1528 wrote to memory of 1076	1528	SearchIndexer.exe	SearchFilterHost.exe
PID 1528 wrote to memory of 1076	1528	SearchIndexer.exe	SearchFilterHost.exe
PID 1528 wrote to memory of 1076	1528	SearchIndexer.exe	SearchFilterHost.exe
PID 1528 wrote to memory of 1224	1528	SearchIndexer.exe	SearchProtocolHost.exe
PID 1528 wrote to memory of 1224	1528	SearchIndexer.exe	SearchProtocolHost.exe
PID 1528 wrote to memory of 1224	1528	SearchIndexer.exe	SearchProtocolHost.exe
PID 1764 wrote to memory of 1744	1764	cmd.exe	rundll32.exe
PID 1764 wrote to memory of 1744	1764	cmd.exe	rundll32.exe
PID 1764 wrote to memory of 1744	1764	cmd.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\overcontrolling.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1664 -s 136
2⤵
- Program crash
PID:1972

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1928

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x140
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:676

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\system32\SearchProtocolHost.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3845472200-3839195424-595303356-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3845472200-3839195424-595303356-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1644

C:\Windows\system32\SearchFilterHost.exe
"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 520
2⤵
PID:1076

C:\Windows\system32\SearchProtocolHost.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
2⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1224

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {9E175B8B-F52A-11D8-B9A5-505054503030} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
PID:1984

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\system32\rundll32.exe
rundll32 overcontrolling.dll init
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1076-94-0x0000000000000000-mapping.dmp

Download
memory/1224-95-0x0000000000000000-mapping.dmp

Download
memory/1528-56-0x0000000001660000-0x0000000001670000-memory.dmp

Filesize
64KB

Download
memory/1528-72-0x0000000001760000-0x0000000001770000-memory.dmp

Filesize
64KB

Download
memory/1528-88-0x00000000011B0000-0x00000000011B8000-memory.dmp

Filesize
32KB

Download
memory/1528-91-0x00000000011B0000-0x00000000011B8000-memory.dmp

Filesize
32KB

Download
memory/1528-92-0x0000000002B90000-0x0000000002B98000-memory.dmp

Filesize
32KB

Download
memory/1644-93-0x0000000000000000-mapping.dmp

Download
memory/1744-97-0x0000000000000000-mapping.dmp

Download
memory/1744-98-0x0000000000120000-0x0000000000129000-memory.dmp

Filesize
36KB

Download
memory/1928-55-0x000007FEFB7B1000-0x000007FEFB7B3000-memory.dmp

Filesize
8KB

Download
memory/1972-54-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads