Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    12-10-2023 16:08

General

  • Target

    8c5c7a8cdda35d77ae8e90a14e0732b6b48e4efb453434ac4d5e7df0e625b06a_JC.vbs

  • Size

    1012KB

  • MD5

    20a3e701e9a1e20c83a8ad5d387ad3cd

  • SHA1

    3b18b70e62aef8d46ba5ad0385d1a0e3d139f2e3

  • SHA256

    8c5c7a8cdda35d77ae8e90a14e0732b6b48e4efb453434ac4d5e7df0e625b06a

  • SHA512

    323e780b368705b7f00d0662530d8c91f4f87a4d17615915976b3b9d88a6b6914a42658c66f2436a9dcc0b48d5ebc463189be69faea56119be7bcef619d64e57

  • SSDEEP

    6144:QI5hC7gl0z9IyjyHUPx9nO3Sd+tw+aN1glujVzB7e1mY1XhnL3Q0zoFIkCMkUZ+b:DNu8C5pNBe1v0lrYvV9V/vj

Malware Config

Extracted

Family

icedid

Campaign

361893872

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Blocklisted process makes network request 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8c5c7a8cdda35d77ae8e90a14e0732b6b48e4efb453434ac4d5e7df0e625b06a_JC.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" C://windows/Temp/0328-1.dll
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2420
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C rundll32.exe C:\Users\Admin\AppData\Local\yokibd\Admin\ejeqacfb1.dll,#1
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2548
        • C:\Windows\system32\rundll32.exe
          rundll32.exe C:\Users\Admin\AppData\Local\yokibd\Admin\ejeqacfb1.dll,#1
          4⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          PID:2684

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Cab7513.tmp

    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

  • C:\Users\Admin\AppData\Local\yokibd\Admin\ejeqacfb1.dll

    Filesize

    556KB

    MD5

    002c64d47bf8c0878ac8ec2b4740f682

    SHA1

    acc44c89420270083de7d67b025748a4b98071ed

    SHA256

    b4f17e438636e166a94b2cd7c83e1c2b3cf1184122b6204521c1024e293ba8b1

    SHA512

    80f44373c7dc7a08d94b65e1f830e6d922ae9b8fefca5beadaf6a1a8c33622219da404bed11daeb7de03f1b3432782a11cd019ff814b981b9e6885066666affd

  • C:\windows\Temp\0328-1.dll

    Filesize

    328KB

    MD5

    8ad0d83ffb343ca6a291b412bf7505e0

    SHA1

    20a379e488b213a36d36a10d5242a197976e048a

    SHA256

    e4bdfa069c1d493eb4add6087d6853360a669686ebd69242b37dd7e65e1b9153

    SHA512

    f3981edac4d4ece3bdf6edcec816c8356e3dc16dc4809443b1e374003140a53c88ef1a3154743a506fde41369f86458e64c04f4f92ef2103221d064b7c61f2ff

  • \Users\Admin\AppData\Local\yokibd\Admin\ejeqacfb1.dll

    Filesize

    556KB

    MD5

    002c64d47bf8c0878ac8ec2b4740f682

    SHA1

    acc44c89420270083de7d67b025748a4b98071ed

    SHA256

    b4f17e438636e166a94b2cd7c83e1c2b3cf1184122b6204521c1024e293ba8b1

    SHA512

    80f44373c7dc7a08d94b65e1f830e6d922ae9b8fefca5beadaf6a1a8c33622219da404bed11daeb7de03f1b3432782a11cd019ff814b981b9e6885066666affd

  • \Users\Admin\AppData\Local\yokibd\Admin\ejeqacfb1.dll

    Filesize

    556KB

    MD5

    002c64d47bf8c0878ac8ec2b4740f682

    SHA1

    acc44c89420270083de7d67b025748a4b98071ed

    SHA256

    b4f17e438636e166a94b2cd7c83e1c2b3cf1184122b6204521c1024e293ba8b1

    SHA512

    80f44373c7dc7a08d94b65e1f830e6d922ae9b8fefca5beadaf6a1a8c33622219da404bed11daeb7de03f1b3432782a11cd019ff814b981b9e6885066666affd

  • \Users\Admin\AppData\Local\yokibd\Admin\ejeqacfb1.dll

    Filesize

    556KB

    MD5

    002c64d47bf8c0878ac8ec2b4740f682

    SHA1

    acc44c89420270083de7d67b025748a4b98071ed

    SHA256

    b4f17e438636e166a94b2cd7c83e1c2b3cf1184122b6204521c1024e293ba8b1

    SHA512

    80f44373c7dc7a08d94b65e1f830e6d922ae9b8fefca5beadaf6a1a8c33622219da404bed11daeb7de03f1b3432782a11cd019ff814b981b9e6885066666affd

  • \Users\Admin\AppData\Local\yokibd\Admin\ejeqacfb1.dll

    Filesize

    556KB

    MD5

    002c64d47bf8c0878ac8ec2b4740f682

    SHA1

    acc44c89420270083de7d67b025748a4b98071ed

    SHA256

    b4f17e438636e166a94b2cd7c83e1c2b3cf1184122b6204521c1024e293ba8b1

    SHA512

    80f44373c7dc7a08d94b65e1f830e6d922ae9b8fefca5beadaf6a1a8c33622219da404bed11daeb7de03f1b3432782a11cd019ff814b981b9e6885066666affd

  • \Windows\Temp\0328-1.dll

    Filesize

    328KB

    MD5

    8ad0d83ffb343ca6a291b412bf7505e0

    SHA1

    20a379e488b213a36d36a10d5242a197976e048a

    SHA256

    e4bdfa069c1d493eb4add6087d6853360a669686ebd69242b37dd7e65e1b9153

    SHA512

    f3981edac4d4ece3bdf6edcec816c8356e3dc16dc4809443b1e374003140a53c88ef1a3154743a506fde41369f86458e64c04f4f92ef2103221d064b7c61f2ff

  • memory/2420-23-0x0000000000120000-0x000000000012D000-memory.dmp

    Filesize

    52KB

  • memory/2420-22-0x0000000000120000-0x000000000012D000-memory.dmp

    Filesize

    52KB

  • memory/2420-3-0x0000000000120000-0x000000000012D000-memory.dmp

    Filesize

    52KB

  • memory/2420-4-0x0000000000120000-0x000000000012D000-memory.dmp

    Filesize

    52KB

  • memory/2684-31-0x0000000001C40000-0x0000000001C8C000-memory.dmp

    Filesize

    304KB

  • memory/2684-30-0x0000000000110000-0x000000000015F000-memory.dmp

    Filesize

    316KB

  • memory/2684-36-0x0000000001C40000-0x0000000001C8C000-memory.dmp

    Filesize

    304KB

  • memory/2684-37-0x0000000001C40000-0x0000000001C8C000-memory.dmp

    Filesize

    304KB

  • memory/2684-38-0x0000000000110000-0x000000000015F000-memory.dmp

    Filesize

    316KB