icedid | d18a6793ee770d1afe40b7b5b8b892a7f918e141533cc4d106bf65e54712d6c3

Analysis

max time kernel
548s
max time network
552s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
20-01-2023 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Copy_INV_01-20.lnk
Size

1KB
MD5

5900b90aa7c89d52dd2a78b71da2b570
SHA1

6acd798b509c629df3a817935e0c77e5dad22a6a
SHA256

a10c3835f7bdb8f30c1126d5ee27dfb74be5c4e73412be9d37a544c6f95ceb4d
SHA512

ca561013b6f4e9ec5de4e8facee720c16d2838f58ece67e71ba4a257f6ea46eb3fdcbcedf325813be249ec553af0bd4b144e1ac1c76719e6523f2c8e8f25a835

Score

10^/10

icedid 886885680 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

886885680

umousteraton.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 10 IoCs

Processes:

rundll32.exe

flow	pid	process
2	564	rundll32.exe
4	564	rundll32.exe
5	564	rundll32.exe
6	564	rundll32.exe
7	564	rundll32.exe
9	564	rundll32.exe
10	564	rundll32.exe
11	564	rundll32.exe
12	564	rundll32.exe
13	564	rundll32.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

564 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

564 rundll32.exe
564 rundll32.exe

pid	process
564	rundll32.exe

pid	process
564	rundll32.exe
564	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

cmd.execmd.exe

description	pid	process	target process
PID 1588 wrote to memory of 1788	1588	cmd.exe	cmd.exe
PID 1588 wrote to memory of 1788	1588	cmd.exe	cmd.exe
PID 1588 wrote to memory of 1788	1588	cmd.exe	cmd.exe
PID 1788 wrote to memory of 568	1788	cmd.exe	xcopy.exe
PID 1788 wrote to memory of 568	1788	cmd.exe	xcopy.exe
PID 1788 wrote to memory of 568	1788	cmd.exe	xcopy.exe
PID 1788 wrote to memory of 564	1788	cmd.exe	rundll32.exe
PID 1788 wrote to memory of 564	1788	cmd.exe	rundll32.exe
PID 1788 wrote to memory of 564	1788	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Copy_INV_01-20.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1588

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c wisbispodi\rajsoldabS.cmd A B C D E F G H I J L L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9
2⤵
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\system32\xcopy.exe
xcopy /s /i /e /h wisbispodi\tunneling.dat C:\Users\Admin\AppData\Local\Temp\*
3⤵
PID:568

C:\Windows\system32\rundll32.exe
rundll32 C:\Users\Admin\AppData\Local\Temp\tunneling.dat,init
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:564

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tunneling.dat
Filesize
514KB

MD5
0b44756101b2f2a79341c08bfebbaf46

SHA1
a7eee2811565316f074f3b3e97eb56c4298eebb4

SHA256
ad174760985c5418b4a3c3a97cd8d7658e3bbb7030f72f2eff9ff97e57f200bd

SHA512
a1d2003a31b7cf15d7b7ab1c9bb86ce4eb4a5d510349972677b5fcdceaf7d106eacb87f946c95d756a892dc962e4144f2bb184a3376e11e97e80f8e05b4ff794

Download Submit
\Users\Admin\AppData\Local\Temp\tunneling.dat
Filesize
514KB

MD5
0b44756101b2f2a79341c08bfebbaf46

SHA1
a7eee2811565316f074f3b3e97eb56c4298eebb4

SHA256
ad174760985c5418b4a3c3a97cd8d7658e3bbb7030f72f2eff9ff97e57f200bd

SHA512
a1d2003a31b7cf15d7b7ab1c9bb86ce4eb4a5d510349972677b5fcdceaf7d106eacb87f946c95d756a892dc962e4144f2bb184a3376e11e97e80f8e05b4ff794

Download Submit
memory/564-94-0x0000000000000000-mapping.dmp

Download
memory/564-97-0x0000000180000000-0x0000000180009000-memory.dmp

Filesize
36KB

Download
memory/568-93-0x0000000000000000-mapping.dmp

Download
memory/1588-54-0x000007FEFBD41000-0x000007FEFBD43000-memory.dmp

Filesize
8KB

Download
memory/1788-89-0x0000000000000000-mapping.dmp

Download