icedid | 5f5f78266fddd18f3db7791b4980df2d13184de9d1c5ac39c49751e25f83ca17

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2023, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Docs_Scan_04_19#69.exe
Size 1.1MB
Sample230419-wwemsace88
SHA256 5f5f78266fddd18f3db7791b4980df2d13184de9d1c5ac39c49751e25f83ca17
MD5 8012fc5d50095169e92680bc7d2cb392
SHA1 41a34528a66e21224d9d3b36ad5e36c8534a7b2d
SHA512 c7905f765cd91b28040e65ca1cc8bc0e4eda492ae1297e8fe2c8c74d7efecb89e04ef881af7cc34ad9b269e87b09e204d8304105de56a463957ed215963c853d
SSDEEP 24576:Vtkb6a0dGxJ4H70Qa8oCHpx7Dr325d5Gsoc2mFBm:VCb6jGQ7YCnLsoc2mFBm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

icedid 422998217 banker loader persistence trojan

Malware Config

Extracted

Family

icedid

Campaign

422998217

skigimeetroc.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Registers COM server for autorun 1 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FE681991-9DE8-11D3-AB75-00805FC73D05}\LocalServer32	Docs_Scan_04_19#69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FE681991-9DE8-11D3-AB75-00805FC73D05}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DOCS_S~1.EXE"	Docs_Scan_04_19#69.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ParticleTest.Document\CLSID	Docs_Scan_04_19#69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ParticleTest.Document\CLSID\ = "{FE681991-9DE8-11D3-AB75-00805FC73D05}"	Docs_Scan_04_19#69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FE681991-9DE8-11D3-AB75-00805FC73D05}\InprocHandler32\ = "ole32.dll"	Docs_Scan_04_19#69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FE681991-9DE8-11D3-AB75-00805FC73D05}\LocalServer32	Docs_Scan_04_19#69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FE681991-9DE8-11D3-AB75-00805FC73D05}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DOCS_S~1.EXE"	Docs_Scan_04_19#69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FE681991-9DE8-11D3-AB75-00805FC73D05}\ProgID\ = "ParticleTest.Document"	Docs_Scan_04_19#69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FE681991-9DE8-11D3-AB75-00805FC73D05}\InprocHandler32	Docs_Scan_04_19#69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ParticleTest.Document	Docs_Scan_04_19#69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ParticleTest.Document\ = "Partic Document"	Docs_Scan_04_19#69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FE681991-9DE8-11D3-AB75-00805FC73D05}	Docs_Scan_04_19#69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FE681991-9DE8-11D3-AB75-00805FC73D05}\ = "Partic Document"	Docs_Scan_04_19#69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FE681991-9DE8-11D3-AB75-00805FC73D05}\ProgID	Docs_Scan_04_19#69.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5056	Docs_Scan_04_19#69.exe
5056	Docs_Scan_04_19#69.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5056	Docs_Scan_04_19#69.exe
5056	Docs_Scan_04_19#69.exe

C:\Users\Admin\AppData\Local\Temp\Docs_Scan_04_19#69.exe
"C:\Users\Admin\AppData\Local\Temp\Docs_Scan_04_19#69.exe"
1⤵
- Registers COM server for autorun
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5056-133-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/5056-140-0x00000000005F0000-0x00000000005F1000-memory.dmp

Download