Analysis

  • max time kernel
    130s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    12-10-2023 15:19

General

  • Target

    30d828fe22893c588e356bc2c8f9e800715923f2ee023141a41c5055f846c1e8_JC.vbs

  • Size

    1012KB

  • MD5

    a9c3b9a30859661eb07c236f5ba977c9

  • SHA1

    cd1d848abee242a083ff8a1633f7cf7ff7ebdafd

  • SHA256

    30d828fe22893c588e356bc2c8f9e800715923f2ee023141a41c5055f846c1e8

  • SHA512

    26bf1ce432541642910280c1f8998370de7206b342ac31f9ee9be1bb614ad0084535eb2dc8adcb9fd0116516e4c7bba5cdfaccffaf8008c8fb39df7f39c8ef04

  • SSDEEP

    6144:iqzIHqFw2r6TjzHFgjiHFgrkqOFtKuByGi7a3TbwLMN7EF8Zz5Z/NjRzWGCpobxU:utS4FMT1u3TbYhKxXzSVif/Dn7GptQDq

Malware Config

Extracted

Family

icedid

Campaign

361893872

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Blocklisted process makes network request 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\30d828fe22893c588e356bc2c8f9e800715923f2ee023141a41c5055f846c1e8_JC.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2088
    • C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" C://windows/Temp/0419-1.dll
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2364
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C rundll32.exe C:\Users\Admin\AppData\Local\Admin\Admin\usuqidaccs3.dll,#1
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2556
        • C:\Windows\system32\rundll32.exe
          rundll32.exe C:\Users\Admin\AppData\Local\Admin\Admin\usuqidaccs3.dll,#1
          4⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          PID:3060

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Admin\Admin\usuqidaccs3.dll

    Filesize

    583KB

    MD5

    0245e02cbb6ffe2716c2aeb7fb8006d0

    SHA1

    59dd3d2477211eb4fcd72b542812a2036fa0e1e8

    SHA256

    5d5bc4f497406b59369901b9a79e1e9d1e0a690c0b2e803f4fbfcb391bcfeef1

    SHA512

    0c2e863512f2d83429e681cbcdb31bf9c6f0a69611f6d8923198d51d1e49750f4bf441c8ce256fb44a9cb39a6855e70fcbc644739926570214400bd06a683d82

  • C:\Users\Admin\AppData\Local\Temp\Cab5A90.tmp

    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

  • C:\windows\Temp\0419-1.dll

    Filesize

    328KB

    MD5

    34c3fc4f3ef5ca3b52268c1727217942

    SHA1

    7269bb5c64e4d74fd74587382faa6901b81ad194

    SHA256

    1fad73f561171c591284bfd5c1bbabcb4ad3c622d15db8d013d57c50cd21e3c7

    SHA512

    a4283f6556b20bda360c579899c41038e18cd77f064ce556acaa200bfadbdeb22c5d47bb4052cd25da275365aef8f5147c957bf4cff29fe74f5b906ff97b4c44

  • \Users\Admin\AppData\Local\Admin\Admin\usuqidaccs3.dll

    Filesize

    583KB

    MD5

    0245e02cbb6ffe2716c2aeb7fb8006d0

    SHA1

    59dd3d2477211eb4fcd72b542812a2036fa0e1e8

    SHA256

    5d5bc4f497406b59369901b9a79e1e9d1e0a690c0b2e803f4fbfcb391bcfeef1

    SHA512

    0c2e863512f2d83429e681cbcdb31bf9c6f0a69611f6d8923198d51d1e49750f4bf441c8ce256fb44a9cb39a6855e70fcbc644739926570214400bd06a683d82

  • \Users\Admin\AppData\Local\Admin\Admin\usuqidaccs3.dll

    Filesize

    583KB

    MD5

    0245e02cbb6ffe2716c2aeb7fb8006d0

    SHA1

    59dd3d2477211eb4fcd72b542812a2036fa0e1e8

    SHA256

    5d5bc4f497406b59369901b9a79e1e9d1e0a690c0b2e803f4fbfcb391bcfeef1

    SHA512

    0c2e863512f2d83429e681cbcdb31bf9c6f0a69611f6d8923198d51d1e49750f4bf441c8ce256fb44a9cb39a6855e70fcbc644739926570214400bd06a683d82

  • \Users\Admin\AppData\Local\Admin\Admin\usuqidaccs3.dll

    Filesize

    583KB

    MD5

    0245e02cbb6ffe2716c2aeb7fb8006d0

    SHA1

    59dd3d2477211eb4fcd72b542812a2036fa0e1e8

    SHA256

    5d5bc4f497406b59369901b9a79e1e9d1e0a690c0b2e803f4fbfcb391bcfeef1

    SHA512

    0c2e863512f2d83429e681cbcdb31bf9c6f0a69611f6d8923198d51d1e49750f4bf441c8ce256fb44a9cb39a6855e70fcbc644739926570214400bd06a683d82

  • \Users\Admin\AppData\Local\Admin\Admin\usuqidaccs3.dll

    Filesize

    583KB

    MD5

    0245e02cbb6ffe2716c2aeb7fb8006d0

    SHA1

    59dd3d2477211eb4fcd72b542812a2036fa0e1e8

    SHA256

    5d5bc4f497406b59369901b9a79e1e9d1e0a690c0b2e803f4fbfcb391bcfeef1

    SHA512

    0c2e863512f2d83429e681cbcdb31bf9c6f0a69611f6d8923198d51d1e49750f4bf441c8ce256fb44a9cb39a6855e70fcbc644739926570214400bd06a683d82

  • \Windows\Temp\0419-1.dll

    Filesize

    328KB

    MD5

    34c3fc4f3ef5ca3b52268c1727217942

    SHA1

    7269bb5c64e4d74fd74587382faa6901b81ad194

    SHA256

    1fad73f561171c591284bfd5c1bbabcb4ad3c622d15db8d013d57c50cd21e3c7

    SHA512

    a4283f6556b20bda360c579899c41038e18cd77f064ce556acaa200bfadbdeb22c5d47bb4052cd25da275365aef8f5147c957bf4cff29fe74f5b906ff97b4c44

  • memory/2364-22-0x0000000000120000-0x000000000012D000-memory.dmp

    Filesize

    52KB

  • memory/2364-4-0x0000000000120000-0x000000000012D000-memory.dmp

    Filesize

    52KB

  • memory/3060-29-0x00000000003B0000-0x00000000003FF000-memory.dmp

    Filesize

    316KB

  • memory/3060-30-0x0000000001B80000-0x0000000001BCC000-memory.dmp

    Filesize

    304KB

  • memory/3060-35-0x0000000001B80000-0x0000000001BCC000-memory.dmp

    Filesize

    304KB

  • memory/3060-36-0x0000000001B80000-0x0000000001BCC000-memory.dmp

    Filesize

    304KB

  • memory/3060-37-0x00000000003B0000-0x00000000003FF000-memory.dmp

    Filesize

    316KB