icedid | 19445d47b6904e3ce904e119ae583d286b6d2c001161b598f5c3ce2e64485792

Analysis

max time kernel
122s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2023 05:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Inv_162_Jan-01_Copy/REF_Scan_01-09.lnk
Size

1KB
MD5

9236173d81765d9eecaffa7bea277241
SHA1

3c6435f4b46131e1eeb45ba87519a42c9b03c103
SHA256

15670b5b4cda3123d0a2f832bf393fbf16d7fa4635558de28220d56c42032b90
SHA512

ea010056be19fc5a3265b3303894b3c9753ed185c1bb7119016e0d8a18d5e9024e68eb48d83a13baa596c0a6646ad96bbf5ae14ad1ca352e39d5a31fec663365

Score

10^/10

icedid 3131022508 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3131022508

wagringamuk.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

6 2116 rundll32.exe
36 2116 rundll32.exe
38 2116 rundll32.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

cmd.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation cmd.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2116 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2116 rundll32.exe
2116 rundll32.exe

flow	pid	process
6	2116	rundll32.exe
36	2116	rundll32.exe
38	2116	rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	cmd.exe

pid	process
2116	rundll32.exe

pid	process
2116	rundll32.exe
2116	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.execmd.exe

description	pid	process	target process
PID 2728 wrote to memory of 3264	2728	cmd.exe	cmd.exe
PID 2728 wrote to memory of 3264	2728	cmd.exe	cmd.exe
PID 3264 wrote to memory of 2240	3264	cmd.exe	xcopy.exe
PID 3264 wrote to memory of 2240	3264	cmd.exe	xcopy.exe
PID 3264 wrote to memory of 2116	3264	cmd.exe	rundll32.exe
PID 3264 wrote to memory of 2116	3264	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Inv_162_Jan-01_Copy\REF_Scan_01-09.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2728

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c eveeftwedK\oakhidtino.cmd A B C D E F G H I J K L M N O P t R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9
2⤵
- Suspicious use of WriteProcessMemory
PID:3264

C:\Windows\system32\xcopy.exe
xcopy /s /i /e /h eveeftwedK\blessing.dat C:\Users\Admin\AppData\Local\Temp\*
3⤵
PID:2240

C:\Windows\system32\rundll32.exe
rundll32 C:\Users\Admin\AppData\Local\Temp\blessing.dat,init
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2116

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\blessing.dat
Filesize
788KB

MD5
15dd0873cb6bef0c8e89a0319a202c3a

SHA1
6b49af73134d502d35d81cb978075761dc3b71fa

SHA256
180bc8d0f85146d6d16fa8079e38ca5e84756f1e201fc7259464addbaee15ff2

SHA512
3b1e4b176835eeae62e5ed4ac65b97e26b4471fba4aa0514c969fac8184fdcecaa82e7c9d286d9bec909bf72cce0c6cce6bfa6ec1a2adadb463a0584d6b8d200

Download Submit
C:\Users\Admin\AppData\Local\Temp\blessing.dat
Filesize
788KB

MD5
15dd0873cb6bef0c8e89a0319a202c3a

SHA1
6b49af73134d502d35d81cb978075761dc3b71fa

SHA256
180bc8d0f85146d6d16fa8079e38ca5e84756f1e201fc7259464addbaee15ff2

SHA512
3b1e4b176835eeae62e5ed4ac65b97e26b4471fba4aa0514c969fac8184fdcecaa82e7c9d286d9bec909bf72cce0c6cce6bfa6ec1a2adadb463a0584d6b8d200

Download Submit
memory/2116-134-0x0000000000000000-mapping.dmp

Download
memory/2116-137-0x0000016335F40000-0x0000016335F49000-memory.dmp

Filesize
36KB

Download
memory/2240-133-0x0000000000000000-mapping.dmp

Download
memory/3264-132-0x0000000000000000-mapping.dmp

Download