icedid | c0a063352598eae28f226207503d864a06f5490497b074a9390927793ea16bfd

General

Target

Setup_Win_31-12-2022_01-50-16.msi
Size

772KB
MD5

4509edb7effdfc57e288bb7b23fa0180
SHA1

edd9910a9b2774e5a9a36ca096d299b092556016
SHA256

c0a063352598eae28f226207503d864a06f5490497b074a9390927793ea16bfd
SHA512

c6a321a42f6235e89b9c256ccdc2d697437baa07574c4da12e65a8c225a007f5da7a6e9b8e14d88a27de19d7b78b5375e3938c5be9054fa62f645fe2420afda0
SSDEEP

12288:TwHL0DpsMX/wg4ZqU0UmmhtNOOdpxoPcrDnS34y9RPF8L:0HL0tvwglMtNjjoGS3bRPF8L

Score

10^/10

icedid 2957048208 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

2957048208

C2

whothitheka.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

26 4292 rundll32.exe
39 4292 rundll32.exe

flow	pid	process
26	4292	rundll32.exe
39	4292	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	rundll32.exe

Loads dropped DLL 3 IoCs

Processes:

MsiExec.exerundll32.exerundll32.exe

pid process

4644 MsiExec.exe
2692 rundll32.exe
4292 rundll32.exe

pid	process
4644	MsiExec.exe
2692	rundll32.exe
4292	rundll32.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Drops file in Windows directory 13 IoCs

Processes:

msiexec.exerundll32.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\e56e9b9.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e56e9bb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBEC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBEC.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIEBEC.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\e56e9b9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6F330B47-2577-43AD-9095-1861BA25889B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEB3F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBEC.tmp-\test.cs.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIEBEC.tmp-\WixSharp.dll	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000106161d2e731958f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000106161d20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900106161d2000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000106161d200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000106161d200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

msiexec.exerundll32.exe

pid process

3428 msiexec.exe
3428 msiexec.exe
4292 rundll32.exe
4292 rundll32.exe

pid	process
3428	msiexec.exe
3428	msiexec.exe
4292	rundll32.exe
4292	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exe

description	pid	process
Token: SeShutdownPrivilege	1508	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1508	msiexec.exe
Token: SeSecurityPrivilege	3428	msiexec.exe
Token: SeCreateTokenPrivilege	1508	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1508	msiexec.exe
Token: SeLockMemoryPrivilege	1508	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1508	msiexec.exe
Token: SeMachineAccountPrivilege	1508	msiexec.exe
Token: SeTcbPrivilege	1508	msiexec.exe
Token: SeSecurityPrivilege	1508	msiexec.exe
Token: SeTakeOwnershipPrivilege	1508	msiexec.exe
Token: SeLoadDriverPrivilege	1508	msiexec.exe
Token: SeSystemProfilePrivilege	1508	msiexec.exe
Token: SeSystemtimePrivilege	1508	msiexec.exe
Token: SeProfSingleProcessPrivilege	1508	msiexec.exe
Token: SeIncBasePriorityPrivilege	1508	msiexec.exe
Token: SeCreatePagefilePrivilege	1508	msiexec.exe
Token: SeCreatePermanentPrivilege	1508	msiexec.exe
Token: SeBackupPrivilege	1508	msiexec.exe
Token: SeRestorePrivilege	1508	msiexec.exe
Token: SeShutdownPrivilege	1508	msiexec.exe
Token: SeDebugPrivilege	1508	msiexec.exe
Token: SeAuditPrivilege	1508	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1508	msiexec.exe
Token: SeChangeNotifyPrivilege	1508	msiexec.exe
Token: SeRemoteShutdownPrivilege	1508	msiexec.exe
Token: SeUndockPrivilege	1508	msiexec.exe
Token: SeSyncAgentPrivilege	1508	msiexec.exe
Token: SeEnableDelegationPrivilege	1508	msiexec.exe
Token: SeManageVolumePrivilege	1508	msiexec.exe
Token: SeImpersonatePrivilege	1508	msiexec.exe
Token: SeCreateGlobalPrivilege	1508	msiexec.exe
Token: SeBackupPrivilege	4404	vssvc.exe
Token: SeRestorePrivilege	4404	vssvc.exe
Token: SeAuditPrivilege	4404	vssvc.exe
Token: SeBackupPrivilege	3428	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe
Token: SeTakeOwnershipPrivilege	3428	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe
Token: SeTakeOwnershipPrivilege	3428	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe
Token: SeTakeOwnershipPrivilege	3428	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe
Token: SeTakeOwnershipPrivilege	3428	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe
Token: SeTakeOwnershipPrivilege	3428	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe
Token: SeTakeOwnershipPrivilege	3428	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe
Token: SeTakeOwnershipPrivilege	3428	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe
Token: SeTakeOwnershipPrivilege	3428	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe
Token: SeTakeOwnershipPrivilege	3428	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe
Token: SeTakeOwnershipPrivilege	3428	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe
Token: SeTakeOwnershipPrivilege	3428	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe
Token: SeTakeOwnershipPrivilege	3428	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe
Token: SeTakeOwnershipPrivilege	3428	msiexec.exe
Token: SeRestorePrivilege	3428	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

1508 msiexec.exe
1508 msiexec.exe

pid	process
1508	msiexec.exe
1508	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

msiexec.exeMsiExec.exerundll32.exe

description	pid	process	target process
PID 3428 wrote to memory of 4276	3428	msiexec.exe	srtasks.exe
PID 3428 wrote to memory of 4276	3428	msiexec.exe	srtasks.exe
PID 3428 wrote to memory of 4644	3428	msiexec.exe	MsiExec.exe
PID 3428 wrote to memory of 4644	3428	msiexec.exe	MsiExec.exe
PID 4644 wrote to memory of 2692	4644	MsiExec.exe	rundll32.exe
PID 4644 wrote to memory of 2692	4644	MsiExec.exe	rundll32.exe
PID 2692 wrote to memory of 4292	2692	rundll32.exe	rundll32.exe
PID 2692 wrote to memory of 4292	2692	rundll32.exe	rundll32.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Setup_Win_31-12-2022_01-50-16.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1508

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3428

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:4276

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 1E21D490B4DDEE454AAA429904670A2D
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4644

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSIEBEC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240577609 2 test.cs!X1X3X2.Y1yY.Z3z1Z
3⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2692

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\MSIc7897c20.msi",init
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4292

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4404

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Peripheral Device Discovery

2

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\MSIc7897c20.msi
Filesize
323KB

MD5
460cf4e821b22e1b3df659a01ee8fb0a

SHA1
1c5ea14ff5f7be7e3d3a62a0d531fc7d0d0a3bf8

SHA256
338c4e044fcd4f8b7429558c283eb13769e0e6afcbf14e9c6bc64d5cc9e3d79a

SHA512
c7bf8859feb207a1178e82402c82c8e4dbaaeae1de4c5220f22a874a8d01fa1944ad91c1d3157bc3f6c1b964a8ac16ab8d00c65fbfdc5d67c7b390afcbe3aec4

Download Submit
C:\Users\Admin\AppData\Local\MSIc7897c20.msi
Filesize
323KB

MD5
460cf4e821b22e1b3df659a01ee8fb0a

SHA1
1c5ea14ff5f7be7e3d3a62a0d531fc7d0d0a3bf8

SHA256
338c4e044fcd4f8b7429558c283eb13769e0e6afcbf14e9c6bc64d5cc9e3d79a

SHA512
c7bf8859feb207a1178e82402c82c8e4dbaaeae1de4c5220f22a874a8d01fa1944ad91c1d3157bc3f6c1b964a8ac16ab8d00c65fbfdc5d67c7b390afcbe3aec4

Download Submit
C:\Windows\Installer\MSIEBEC.tmp
Filesize
414KB

MD5
93de80a9ce7643dd46c5486de3bbd321

SHA1
af84880e7259b812abc4d1bd4390d594e05f0f75

SHA256
e389c34819359687adc18cf20534842b9e66dc101ea8497e70d0ae217f7081eb

SHA512
0b0394914c6ca4ae401244f9690760f56937f69e6dc2b65033e3586aaa479508b13ae4b1f5a7308d96834756a8ca1ae97b6f5b360f2c429794c170c42e4e0c16

Download Submit
C:\Windows\Installer\MSIEBEC.tmp
Filesize
414KB

MD5
93de80a9ce7643dd46c5486de3bbd321

SHA1
af84880e7259b812abc4d1bd4390d594e05f0f75

SHA256
e389c34819359687adc18cf20534842b9e66dc101ea8497e70d0ae217f7081eb

SHA512
0b0394914c6ca4ae401244f9690760f56937f69e6dc2b65033e3586aaa479508b13ae4b1f5a7308d96834756a8ca1ae97b6f5b360f2c429794c170c42e4e0c16

Download Submit
C:\Windows\Installer\MSIEBEC.tmp
Filesize
414KB

MD5
93de80a9ce7643dd46c5486de3bbd321

SHA1
af84880e7259b812abc4d1bd4390d594e05f0f75

SHA256
e389c34819359687adc18cf20534842b9e66dc101ea8497e70d0ae217f7081eb

SHA512
0b0394914c6ca4ae401244f9690760f56937f69e6dc2b65033e3586aaa479508b13ae4b1f5a7308d96834756a8ca1ae97b6f5b360f2c429794c170c42e4e0c16

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Filesize
23.0MB

MD5
30c9f79cc92b0627fbe43c7d7185b63e

SHA1
5f72980f44460557b72f69dcc5849986de6e66e6

SHA256
3fd3fd30316b8a90ac60045d4e41a951f061def706676e1e00be6fe2088678b7

SHA512
53c2d2e72dfb09f49301897ceb35f4ca276b93543a8c0cd5e39a174b17fdc178d7aa46ea9294a0de5fba6ecb0668d5495a78a8cfc4a252e8346b598f812e78a4

Download Submit
\??\Volume{d2616110-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3a02e73f-ed2f-4251-93b1-c4f698795b5a}_OnDiskSnapshotProp
Filesize
5KB

MD5
da412f5274d2d0693b30a16953889ce0

SHA1
9e77e8c7e792d80c2946ddd4ae39ba79405a1a9b

SHA256
7a4ba13cb4c4860840e19517b800e84c3dd3cba2932d3c04352e58441288e5f6

SHA512
858bce7326b1cdccd12fa1d2e49922cf5ed5b42016eea0a956fd1a761fe48ca5903d218d7a12e85d9762df1af69f06199f9ffbb19afab76aa8ba4a4aec4adf61

Download Submit
memory/2692-136-0x0000000000000000-mapping.dmp

Download
memory/2692-140-0x0000021A4B6A0000-0x0000021A4B710000-memory.dmp

Filesize
448KB

Download
memory/2692-143-0x00007FF9D3810000-0x00007FF9D42D1000-memory.dmp

Filesize
10.8MB

Download
memory/2692-139-0x0000021A4B410000-0x0000021A4B41A000-memory.dmp

Filesize
40KB

Download
memory/2692-138-0x0000021A4B430000-0x0000021A4B45E000-memory.dmp

Filesize
184KB

Download
memory/2692-147-0x00007FF9D3810000-0x00007FF9D42D1000-memory.dmp

Filesize
10.8MB

Download
memory/4276-132-0x0000000000000000-mapping.dmp

Download
memory/4292-141-0x0000000000000000-mapping.dmp

Download
memory/4292-145-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/4644-133-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads