Analysis

  • max time kernel
    142s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-10-2023 15:19

General

  • Target

    30d828fe22893c588e356bc2c8f9e800715923f2ee023141a41c5055f846c1e8_JC.vbs

  • Size

    1012KB

  • MD5

    a9c3b9a30859661eb07c236f5ba977c9

  • SHA1

    cd1d848abee242a083ff8a1633f7cf7ff7ebdafd

  • SHA256

    30d828fe22893c588e356bc2c8f9e800715923f2ee023141a41c5055f846c1e8

  • SHA512

    26bf1ce432541642910280c1f8998370de7206b342ac31f9ee9be1bb614ad0084535eb2dc8adcb9fd0116516e4c7bba5cdfaccffaf8008c8fb39df7f39c8ef04

  • SSDEEP

    6144:iqzIHqFw2r6TjzHFgjiHFgrkqOFtKuByGi7a3TbwLMN7EF8Zz5Z/NjRzWGCpobxU:utS4FMT1u3TbYhKxXzSVif/Dn7GptQDq

Malware Config

Extracted

Family

icedid

Campaign

361893872

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Blocklisted process makes network request 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\30d828fe22893c588e356bc2c8f9e800715923f2ee023141a41c5055f846c1e8_JC.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:904
    • C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" C://windows/Temp/0419-1.dll
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3164
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C rundll32.exe C:\Users\Admin\AppData\Roaming\Viapbd\Axyifoacne.dll,#1
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4240
        • C:\Windows\system32\rundll32.exe
          rundll32.exe C:\Users\Admin\AppData\Roaming\Viapbd\Axyifoacne.dll,#1
          4⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Modifies registry class
          PID:4576

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Viapbd\Axyifoacne.dll

    Filesize

    583KB

    MD5

    0245e02cbb6ffe2716c2aeb7fb8006d0

    SHA1

    59dd3d2477211eb4fcd72b542812a2036fa0e1e8

    SHA256

    5d5bc4f497406b59369901b9a79e1e9d1e0a690c0b2e803f4fbfcb391bcfeef1

    SHA512

    0c2e863512f2d83429e681cbcdb31bf9c6f0a69611f6d8923198d51d1e49750f4bf441c8ce256fb44a9cb39a6855e70fcbc644739926570214400bd06a683d82

  • C:\Users\Admin\AppData\Roaming\Viapbd\Axyifoacne.dll

    Filesize

    583KB

    MD5

    0245e02cbb6ffe2716c2aeb7fb8006d0

    SHA1

    59dd3d2477211eb4fcd72b542812a2036fa0e1e8

    SHA256

    5d5bc4f497406b59369901b9a79e1e9d1e0a690c0b2e803f4fbfcb391bcfeef1

    SHA512

    0c2e863512f2d83429e681cbcdb31bf9c6f0a69611f6d8923198d51d1e49750f4bf441c8ce256fb44a9cb39a6855e70fcbc644739926570214400bd06a683d82

  • C:\Windows\Temp\0419-1.dll

    Filesize

    328KB

    MD5

    34c3fc4f3ef5ca3b52268c1727217942

    SHA1

    7269bb5c64e4d74fd74587382faa6901b81ad194

    SHA256

    1fad73f561171c591284bfd5c1bbabcb4ad3c622d15db8d013d57c50cd21e3c7

    SHA512

    a4283f6556b20bda360c579899c41038e18cd77f064ce556acaa200bfadbdeb22c5d47bb4052cd25da275365aef8f5147c957bf4cff29fe74f5b906ff97b4c44

  • C:\windows\Temp\0419-1.dll

    Filesize

    328KB

    MD5

    34c3fc4f3ef5ca3b52268c1727217942

    SHA1

    7269bb5c64e4d74fd74587382faa6901b81ad194

    SHA256

    1fad73f561171c591284bfd5c1bbabcb4ad3c622d15db8d013d57c50cd21e3c7

    SHA512

    a4283f6556b20bda360c579899c41038e18cd77f064ce556acaa200bfadbdeb22c5d47bb4052cd25da275365aef8f5147c957bf4cff29fe74f5b906ff97b4c44

  • memory/3164-4-0x0000000002790000-0x000000000279D000-memory.dmp

    Filesize

    52KB

  • memory/3164-8-0x0000000002790000-0x000000000279D000-memory.dmp

    Filesize

    52KB

  • memory/4576-12-0x000001AEAB470000-0x000001AEAB4BF000-memory.dmp

    Filesize

    316KB

  • memory/4576-13-0x000001AEAB630000-0x000001AEAB67C000-memory.dmp

    Filesize

    304KB

  • memory/4576-18-0x000001AEAB630000-0x000001AEAB67C000-memory.dmp

    Filesize

    304KB

  • memory/4576-19-0x000001AEAB630000-0x000001AEAB67C000-memory.dmp

    Filesize

    304KB

  • memory/4576-20-0x000001AEAB470000-0x000001AEAB4BF000-memory.dmp

    Filesize

    316KB

  • memory/4576-23-0x000001AEAB630000-0x000001AEAB67C000-memory.dmp

    Filesize

    304KB

  • memory/4576-24-0x000001AEAB630000-0x000001AEAB67C000-memory.dmp

    Filesize

    304KB

  • memory/4576-26-0x000001AEAB630000-0x000001AEAB67C000-memory.dmp

    Filesize

    304KB