icedid | f3a9b733cb33c4d257589e70c8d9cf4b5136cb3932bce2ea1b31bc9d5b06a5ae

Resubmissions

26-12-2022 18:03

221226-wnchfsge5w 3

26-12-2022 12:51

221226-p3jrragb4y 10

Analysis

max time kernel
135s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2022 12:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Request_12-23#183.iso
Size

2.1MB
MD5

2f39a11049419baf7305d6abf0d45dfc
SHA1

2c9b2484039b387aac6f1c6fbe3c6ab05e728edd
SHA256

f3a9b733cb33c4d257589e70c8d9cf4b5136cb3932bce2ea1b31bc9d5b06a5ae
SHA512

e1f42636f1f4684672d1f2ea6b01cb073dd8c51ba28b8fabff5394f921bc73b1b4bdd942a329a2d32b16254a8b8a47940e2409986a992cce7dc0e6015fe13eb8
SSDEEP

12288:4/pNfmaYOTAl0PFX783QgZGXNfnD4SpZi+wwLMfEWm+CJthm:4/zf8j0FXY3Q5XN7pY+wwxZjJthm

Score

10^/10

icedid 3146401099 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3146401099

trbiriumpa.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

56 3760 rundll32.exe
58 3760 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings cmd.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

3760 rundll32.exe
3760 rundll32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

cmd.exe

description pid process

Token: SeManageVolumePrivilege 4988 cmd.exe
Token: SeManageVolumePrivilege 4988 cmd.exe

flow	pid	process
56	3760	rundll32.exe
58	3760	rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe

pid	process
3760	rundll32.exe
3760	rundll32.exe

description	pid	process
Token: SeManageVolumePrivilege	4988	cmd.exe
Token: SeManageVolumePrivilege	4988	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Request_12-23#183.iso
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4988

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4512

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" \dinhub.dat,init
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:3760

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3760-132-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download