icedid | 7aec2958937bdce9572aab569a5e639594dd99e53481dea6b637a50c1f21bb24

Analysis

max time kernel
121s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
19-01-2023 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New folder/Copy_Document_01-19.lnk
Size

1KB
MD5

95174ee1b5da79b632d2ba14e5c25622
SHA1

a60ba4fb1ea86520aa10fc170665249e39fd5a38
SHA256

d52c73ab74ee564b66d6ec2195c4f6c28a26299b6ba55422c8bfd4f027c8f1b9
SHA512

164f285fc68fcae9ff3eec66ba77479afc52cf834fdff2743685c87e6fa03e73264bf51befeb3f5ea0a724181a3b1099738855325e988dfa8a168581ef134c55

Score

10^/10

icedid 3108046779 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3108046779

klayerziluska.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

9 5020 rundll32.exe
37 5020 rundll32.exe
40 5020 rundll32.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

cmd.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation cmd.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

5020 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

5020 rundll32.exe
5020 rundll32.exe

flow	pid	process
9	5020	rundll32.exe
37	5020	rundll32.exe
40	5020	rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	cmd.exe

pid	process
5020	rundll32.exe

pid	process
5020	rundll32.exe
5020	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.execmd.exe

description	pid	process	target process
PID 2912 wrote to memory of 4680	2912	cmd.exe	cmd.exe
PID 2912 wrote to memory of 4680	2912	cmd.exe	cmd.exe
PID 4680 wrote to memory of 1140	4680	cmd.exe	xcopy.exe
PID 4680 wrote to memory of 1140	4680	cmd.exe	xcopy.exe
PID 4680 wrote to memory of 5020	4680	cmd.exe	rundll32.exe
PID 4680 wrote to memory of 5020	4680	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\New folder\Copy_Document_01-19.lnk"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2912

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c fogduepetf\oftsaginnT.cmd A B C D v F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9
2⤵
- Suspicious use of WriteProcessMemory
PID:4680

C:\Windows\system32\xcopy.exe
xcopy /s /i /e /h fogduepetf\rencountering.dat C:\Users\Admin\AppData\Local\Temp\*
3⤵
PID:1140

C:\Windows\system32\rundll32.exe
rundll32 C:\Users\Admin\AppData\Local\Temp\rencountering.dat,init
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5020

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rencountering.dat
Filesize
1002KB

MD5
d0515acd0a80ad5273ad189e72aca86f

SHA1
494b7f00ee4e2a47c3b6e25f7fc603ea9f3ae1d5

SHA256
265c1857ac7c20432f36e3967511f1be0b84b1c52e4867889e367c0b5828a844

SHA512
2da2dc75b9aca01e0133ad119e194ba52b4f929289b8f23c13da9ef2c9e8c00f5a245b177a22207e168dd7039279357abd7bc13757e982f1088643720749d0aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\rencountering.dat
Filesize
1002KB

MD5
d0515acd0a80ad5273ad189e72aca86f

SHA1
494b7f00ee4e2a47c3b6e25f7fc603ea9f3ae1d5

SHA256
265c1857ac7c20432f36e3967511f1be0b84b1c52e4867889e367c0b5828a844

SHA512
2da2dc75b9aca01e0133ad119e194ba52b4f929289b8f23c13da9ef2c9e8c00f5a245b177a22207e168dd7039279357abd7bc13757e982f1088643720749d0aa

Download Submit
memory/1140-133-0x0000000000000000-mapping.dmp

Download
memory/4680-132-0x0000000000000000-mapping.dmp

Download
memory/5020-134-0x0000000000000000-mapping.dmp

Download
memory/5020-137-0x000001A7E4670000-0x000001A7E4679000-memory.dmp

Filesize
36KB

Download