icedid | ecdb5191814457d5ee4fa334e21d15b66b848d54c47c90ef2af82e40e58f71d9

Analysis

max time kernel
283s
max time network
286s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2022 18:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Docs_REF-1228#109.iso
Size

1.9MB
MD5

c3af9dc149f88a2541293cbf6eab4867
SHA1

a5de23a20db4dec2dd6f9ca41cbdf617ef2094b9
SHA256

ecdb5191814457d5ee4fa334e21d15b66b848d54c47c90ef2af82e40e58f71d9
SHA512

204aaf9b8b4c6d7b262cfe1405e1f16558a394812ee6cb12f4468c81dd6ade3d2d5c71bc0cb21ea0e91ef8561393050fe40c368b449c153e246d4a2957b1d1de
SSDEEP

6144:dUvv0OBrH6xz/YKp/1cCMC/pA9sedEr9hrqxyxF4ZTg1JP9uffWVIh8IKYlPA8x4:6v8OdBCMYCespKIA8x

Score

10^/10

icedid 3247066813 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3247066813

whothitheka.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

46 4752 rundll32.exe
51 4752 rundll32.exe
54 4752 rundll32.exe
55 4752 rundll32.exe
56 4752 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings cmd.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

4752 rundll32.exe
4752 rundll32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

cmd.exe

description pid process

Token: SeManageVolumePrivilege 5076 cmd.exe
Token: SeManageVolumePrivilege 5076 cmd.exe

flow	pid	process
46	4752	rundll32.exe
51	4752	rundll32.exe
54	4752	rundll32.exe
55	4752	rundll32.exe
56	4752	rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	cmd.exe

pid	process
4752	rundll32.exe
4752	rundll32.exe

description	pid	process
Token: SeManageVolumePrivilege	5076	cmd.exe
Token: SeManageVolumePrivilege	5076	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Docs_REF-1228#109.iso
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3248

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" \coyfig.dat,init
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4752

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4752-132-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download