Analysis
- max time kernel
148s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
24/12/2022, 18:01
General
- Target happypetsweymouth.co,doc,12.23.22.docm
- Size 1.3MB
- Sample221224-wlxevade7v
- SHA256 cdeb995aa0014da04d86e84c40524ab2f45ce63ef7f3ce9fce04284e14faff2e
Malware Config
Extracted
-
icedid
-
1212497363
-
trbiriumpa.com
Signatures
- IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 3 IoCs
- Loads dropped DLL 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\happypetsweymouth.co,doc,12.23.22.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\rundll32.exerundll32 C:\ProgramData\KBFR5.DLL,init1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
KBFR5.DLL
KBFR5.DLL
memory/2220-141-0x0000000180000000-0x0000000180009000-memory.dmp
memory/4572-135-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp
memory/4572-136-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp
memory/4572-137-0x00007FF7F2860000-0x00007FF7F2870000-memory.dmp
memory/4572-138-0x00007FF7F2860000-0x00007FF7F2870000-memory.dmp
memory/4572-132-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp
memory/4572-134-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp
memory/4572-133-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp
memory/4572-148-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp
memory/4572-149-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp
memory/4572-150-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp
memory/4572-151-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp