icedid | hxxps://firebasestorage[.]googleapis[.]com/v0/b/profound-veld-372422[.]appspot[.]com/o/6ncxCfGfXG%2FPaid_Offer_83_Jan_19[.]zip?alt=media&token=df54093b-4acf-45a1-8c62-d1100bc5a46f

General

Target

https://firebasestorage.googleapis.com/v0/b/profound-veld-372422.appspot.com/o/6ncxCfGfXG%2FPaid_Offer_83_Jan_19.zip?alt=media&token=df54093b-4acf-45a1-8c62-d1100bc5a46f

Score

10^/10

icedid 3108046779 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3108046779

C2

klayerziluska.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2652 rundll32.exe
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

cmd.exe

description ioc process

File opened (read-only) \??\E: cmd.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4196 2276 WerFault.exe

pid	process
2652	rundll32.exe

description	ioc	process
File opened (read-only)	\??\E:	cmd.exe

pid	pid_target	process	target process
4196	2276	WerFault.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 8497dd5115f6d801	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 23 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "989766946"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003c000000900300001c020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{666EF836-9B44-11ED-BF5F-DEE008EA10AF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31010641"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31010641"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{2106DE1F-9BAF-49BB-8A71-465BE74A00B6}"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "989766946"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe

Modifies registry class 1 IoCs

Processes:

iexplore.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings iexplore.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2652 rundll32.exe
2652 rundll32.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exe

pid process

4312 iexplore.exe
4312 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

4312 iexplore.exe
4312 iexplore.exe
4692 IEXPLORE.EXE
4692 IEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	iexplore.exe

pid	process
2652	rundll32.exe
2652	rundll32.exe

pid	process
4312	iexplore.exe
4312	iexplore.exe

pid	process
4312	iexplore.exe
4312	iexplore.exe
4692	IEXPLORE.EXE
4692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

iexplore.execmd.exe

description	pid	process	target process
PID 4312 wrote to memory of 4692	4312	iexplore.exe	IEXPLORE.EXE
PID 4312 wrote to memory of 4692	4312	iexplore.exe	IEXPLORE.EXE
PID 4312 wrote to memory of 4692	4312	iexplore.exe	IEXPLORE.EXE
PID 884 wrote to memory of 1160	884	cmd.exe	xcopy.exe
PID 884 wrote to memory of 1160	884	cmd.exe	xcopy.exe
PID 884 wrote to memory of 2652	884	cmd.exe	rundll32.exe
PID 884 wrote to memory of 2652	884	cmd.exe	rundll32.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://firebasestorage.googleapis.com/v0/b/profound-veld-372422.appspot.com/o/6ncxCfGfXG%2FPaid_Offer_83_Jan_19.zip?alt=media&token=df54093b-4acf-45a1-8c62-d1100bc5a46f
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4312 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4692

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3832

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 480 -p 2276 -ip 2276
1⤵
PID:996

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2276 -s 768
1⤵
- Program crash
PID:4196

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c ragpewleaK\lawfinledr.cmd A B C D I F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:884

C:\Windows\system32\xcopy.exe
xcopy /s /i /e /h ragpewleaK\overprogramming.dat C:\Users\Admin\AppData\Local\Temp\*
2⤵
PID:1160

C:\Windows\system32\rundll32.exe
rundll32 C:\Users\Admin\AppData\Local\Temp\overprogramming.dat,init
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2652

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1TQVPNOO\Paid_Offer_83_Jan_19.zip.8ub3fsc.partial
Filesize
485KB

MD5
b0116889f3552f541a26d8b54517a6b8

SHA1
b1e565709d59b4fa2de37a1bfcd2c49254dab48c

SHA256
34cecd5a9044d95734b6b8876695e1f4f0a98c852902af352cfdfe15dab18cc3

SHA512
2f824b629b8142a1860cf62006953ffee9a5a7080c976969334352fc423f7c381e331c5787132943615cf7387ca86aa773b31ce4c2791e29528aff0f3e8654bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\overprogramming.dat
Filesize
1002KB

MD5
d0515acd0a80ad5273ad189e72aca86f

SHA1
494b7f00ee4e2a47c3b6e25f7fc603ea9f3ae1d5

SHA256
265c1857ac7c20432f36e3967511f1be0b84b1c52e4867889e367c0b5828a844

SHA512
2da2dc75b9aca01e0133ad119e194ba52b4f929289b8f23c13da9ef2c9e8c00f5a245b177a22207e168dd7039279357abd7bc13757e982f1088643720749d0aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\overprogramming.dat
Filesize
1002KB

MD5
d0515acd0a80ad5273ad189e72aca86f

SHA1
494b7f00ee4e2a47c3b6e25f7fc603ea9f3ae1d5

SHA256
265c1857ac7c20432f36e3967511f1be0b84b1c52e4867889e367c0b5828a844

SHA512
2da2dc75b9aca01e0133ad119e194ba52b4f929289b8f23c13da9ef2c9e8c00f5a245b177a22207e168dd7039279357abd7bc13757e982f1088643720749d0aa

Download Submit
memory/1160-133-0x0000000000000000-mapping.dmp

Download
memory/2652-134-0x0000000000000000-mapping.dmp

Download
memory/2652-137-0x0000020267200000-0x0000020267209000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads