Malware Analysis Report

2024-10-18 23:50

Sample ID 231012-tlqwysad9x
Target 8c5c7a8cdda35d77ae8e90a14e0732b6b48e4efb453434ac4d5e7df0e625b06a_JC.vbs
SHA256 8c5c7a8cdda35d77ae8e90a14e0732b6b48e4efb453434ac4d5e7df0e625b06a
Tags
icedid 361893872 banker trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8c5c7a8cdda35d77ae8e90a14e0732b6b48e4efb453434ac4d5e7df0e625b06a

Threat Level: Known bad

The file 8c5c7a8cdda35d77ae8e90a14e0732b6b48e4efb453434ac4d5e7df0e625b06a_JC.vbs was found to be: Known bad.

Malicious Activity Summary

icedid 361893872 banker trojan

IcedID, BokBot

Blocklisted process makes network request

Loads dropped DLL

Checks computer location settings

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Modifies registry class

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-12 16:08

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-12 16:08

Reported

2023-10-16 17:16

Platform

win7-20230831-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8c5c7a8cdda35d77ae8e90a14e0732b6b48e4efb453434ac4d5e7df0e625b06a_JC.vbs"

Signatures

IcedID, BokBot

trojan banker icedid

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\regsvr32.exe N/A
N/A N/A C:\Windows\System32\regsvr32.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8c5c7a8cdda35d77ae8e90a14e0732b6b48e4efb453434ac4d5e7df0e625b06a_JC.vbs"

C:\Windows\System32\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" C://windows/Temp/0328-1.dll

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C rundll32.exe C:\Users\Admin\AppData\Local\yokibd\Admin\ejeqacfb1.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\yokibd\Admin\ejeqacfb1.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 modalefastnow.com udp
IQ 212.18.104.12:443 modalefastnow.com tcp
IQ 212.18.104.12:80 modalefastnow.com tcp
US 8.8.8.8:53 jkbarmossen.com udp
US 173.255.204.62:443 jkbarmossen.com tcp
US 8.8.8.8:53 evinakortu.com udp
BG 94.232.46.27:443 evinakortu.com tcp
US 8.8.8.8:53 hofsaalos.com udp
RU 92.118.112.113:443 hofsaalos.com tcp
US 8.8.8.8:53 skrechelres.com udp

Files

C:\windows\Temp\0328-1.dll

MD5 8ad0d83ffb343ca6a291b412bf7505e0
SHA1 20a379e488b213a36d36a10d5242a197976e048a
SHA256 e4bdfa069c1d493eb4add6087d6853360a669686ebd69242b37dd7e65e1b9153
SHA512 f3981edac4d4ece3bdf6edcec816c8356e3dc16dc4809443b1e374003140a53c88ef1a3154743a506fde41369f86458e64c04f4f92ef2103221d064b7c61f2ff

\Windows\Temp\0328-1.dll

MD5 8ad0d83ffb343ca6a291b412bf7505e0
SHA1 20a379e488b213a36d36a10d5242a197976e048a
SHA256 e4bdfa069c1d493eb4add6087d6853360a669686ebd69242b37dd7e65e1b9153
SHA512 f3981edac4d4ece3bdf6edcec816c8356e3dc16dc4809443b1e374003140a53c88ef1a3154743a506fde41369f86458e64c04f4f92ef2103221d064b7c61f2ff

memory/2420-4-0x0000000000120000-0x000000000012D000-memory.dmp

memory/2420-3-0x0000000000120000-0x000000000012D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab7513.tmp

MD5 f3441b8572aae8801c04f3060b550443
SHA1 4ef0a35436125d6821831ef36c28ffaf196cda15
SHA256 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA512 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

memory/2420-22-0x0000000000120000-0x000000000012D000-memory.dmp

memory/2420-23-0x0000000000120000-0x000000000012D000-memory.dmp

\Users\Admin\AppData\Local\yokibd\Admin\ejeqacfb1.dll

MD5 002c64d47bf8c0878ac8ec2b4740f682
SHA1 acc44c89420270083de7d67b025748a4b98071ed
SHA256 b4f17e438636e166a94b2cd7c83e1c2b3cf1184122b6204521c1024e293ba8b1
SHA512 80f44373c7dc7a08d94b65e1f830e6d922ae9b8fefca5beadaf6a1a8c33622219da404bed11daeb7de03f1b3432782a11cd019ff814b981b9e6885066666affd

\Users\Admin\AppData\Local\yokibd\Admin\ejeqacfb1.dll

MD5 002c64d47bf8c0878ac8ec2b4740f682
SHA1 acc44c89420270083de7d67b025748a4b98071ed
SHA256 b4f17e438636e166a94b2cd7c83e1c2b3cf1184122b6204521c1024e293ba8b1
SHA512 80f44373c7dc7a08d94b65e1f830e6d922ae9b8fefca5beadaf6a1a8c33622219da404bed11daeb7de03f1b3432782a11cd019ff814b981b9e6885066666affd

\Users\Admin\AppData\Local\yokibd\Admin\ejeqacfb1.dll

MD5 002c64d47bf8c0878ac8ec2b4740f682
SHA1 acc44c89420270083de7d67b025748a4b98071ed
SHA256 b4f17e438636e166a94b2cd7c83e1c2b3cf1184122b6204521c1024e293ba8b1
SHA512 80f44373c7dc7a08d94b65e1f830e6d922ae9b8fefca5beadaf6a1a8c33622219da404bed11daeb7de03f1b3432782a11cd019ff814b981b9e6885066666affd

C:\Users\Admin\AppData\Local\yokibd\Admin\ejeqacfb1.dll

MD5 002c64d47bf8c0878ac8ec2b4740f682
SHA1 acc44c89420270083de7d67b025748a4b98071ed
SHA256 b4f17e438636e166a94b2cd7c83e1c2b3cf1184122b6204521c1024e293ba8b1
SHA512 80f44373c7dc7a08d94b65e1f830e6d922ae9b8fefca5beadaf6a1a8c33622219da404bed11daeb7de03f1b3432782a11cd019ff814b981b9e6885066666affd

\Users\Admin\AppData\Local\yokibd\Admin\ejeqacfb1.dll

MD5 002c64d47bf8c0878ac8ec2b4740f682
SHA1 acc44c89420270083de7d67b025748a4b98071ed
SHA256 b4f17e438636e166a94b2cd7c83e1c2b3cf1184122b6204521c1024e293ba8b1
SHA512 80f44373c7dc7a08d94b65e1f830e6d922ae9b8fefca5beadaf6a1a8c33622219da404bed11daeb7de03f1b3432782a11cd019ff814b981b9e6885066666affd

memory/2684-31-0x0000000001C40000-0x0000000001C8C000-memory.dmp

memory/2684-30-0x0000000000110000-0x000000000015F000-memory.dmp

memory/2684-36-0x0000000001C40000-0x0000000001C8C000-memory.dmp

memory/2684-37-0x0000000001C40000-0x0000000001C8C000-memory.dmp

memory/2684-38-0x0000000000110000-0x000000000015F000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-12 16:08

Reported

2023-10-16 17:16

Platform

win10v2004-20230915-en

Max time kernel

183s

Max time network

197s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8c5c7a8cdda35d77ae8e90a14e0732b6b48e4efb453434ac4d5e7df0e625b06a_JC.vbs"

Signatures

IcedID, BokBot

trojan banker icedid

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\System32\regsvr32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\CLSID\{BF545EFF-1B42-ED22-5E98-BCE1DD3C18F3} C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\CLSID\{BF545EFF-1B42-ED22-5E98-BCE1DD3C18F3}\ = 7cd98d73c18b257af5fc6b4971cd8c70b5266bd5e03416c4973be746089f282b1b8de11e484aeb0f4a548253357a74f303db36dfcdbfdcb54487c9a5fcc6190eda54828104ae37d791e941b68b557d18076bf58c17955b234f37cb5ec7a9ec483349d48a206617f18e24e6c6279be9154007bdfe1a4a4874201db1a1ce38cfa1813dcd11c6552375c286395f42bd1ae87422cb4e57c186e5972452a4fd46d215c19f3f000efa156134d591385753205b51f89cab8bd82e41214c295c57d062af8774944ddf04eefbe370bc0df0632996035b438404ec6ea2f0c98e8334d4e5257b9106404642cb02e66ba5082d2548458786ad0f73492cbf04f86a2287cc5967b3943eda8319e0efbcfefcf3bcf0f6e960d3f94e C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\regsvr32.exe N/A
N/A N/A C:\Windows\System32\regsvr32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2936 wrote to memory of 2820 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\regsvr32.exe
PID 2936 wrote to memory of 2820 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\regsvr32.exe
PID 2820 wrote to memory of 2236 N/A C:\Windows\System32\regsvr32.exe C:\Windows\System32\cmd.exe
PID 2820 wrote to memory of 2236 N/A C:\Windows\System32\regsvr32.exe C:\Windows\System32\cmd.exe
PID 2236 wrote to memory of 4852 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\rundll32.exe
PID 2236 wrote to memory of 4852 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\rundll32.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8c5c7a8cdda35d77ae8e90a14e0732b6b48e4efb453434ac4d5e7df0e625b06a_JC.vbs"

C:\Windows\System32\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" C://windows/Temp/0328-1.dll

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C rundll32.exe C:\Users\Admin\AppData\Roaming\{1BA8F424-A89D-88F1-16F4-42A663196520}\ahqowiackf2.dll,#1

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Roaming\{1BA8F424-A89D-88F1-16F4-42A663196520}\ahqowiackf2.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 254.5.248.8.in-addr.arpa udp
US 8.8.8.8:53 modalefastnow.com udp
IQ 212.18.104.12:443 modalefastnow.com tcp
US 8.8.8.8:53 12.104.18.212.in-addr.arpa udp
IQ 212.18.104.12:80 modalefastnow.com tcp
US 8.8.8.8:53 modalefastnow.com udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.57.101.20.in-addr.arpa udp
US 8.8.8.8:53 6.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 hofsaalos.com udp
RU 92.118.112.113:443 hofsaalos.com tcp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 skrechelres.com udp
US 8.8.8.8:53 jerryposter.com udp
RU 77.105.140.181:443 jerryposter.com tcp
US 8.8.8.8:53 181.140.105.77.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp

Files

C:\windows\Temp\0328-1.dll

MD5 8ad0d83ffb343ca6a291b412bf7505e0
SHA1 20a379e488b213a36d36a10d5242a197976e048a
SHA256 e4bdfa069c1d493eb4add6087d6853360a669686ebd69242b37dd7e65e1b9153
SHA512 f3981edac4d4ece3bdf6edcec816c8356e3dc16dc4809443b1e374003140a53c88ef1a3154743a506fde41369f86458e64c04f4f92ef2103221d064b7c61f2ff

C:\Windows\Temp\0328-1.dll

MD5 8ad0d83ffb343ca6a291b412bf7505e0
SHA1 20a379e488b213a36d36a10d5242a197976e048a
SHA256 e4bdfa069c1d493eb4add6087d6853360a669686ebd69242b37dd7e65e1b9153
SHA512 f3981edac4d4ece3bdf6edcec816c8356e3dc16dc4809443b1e374003140a53c88ef1a3154743a506fde41369f86458e64c04f4f92ef2103221d064b7c61f2ff

memory/2820-4-0x0000000001210000-0x000000000121D000-memory.dmp

memory/2820-7-0x0000000001210000-0x000000000121D000-memory.dmp

memory/2820-9-0x0000000001210000-0x000000000121D000-memory.dmp

C:\Users\Admin\AppData\Roaming\{1BA8F424-A89D-88F1-16F4-42A663196520}\ahqowiackf2.dll

MD5 002c64d47bf8c0878ac8ec2b4740f682
SHA1 acc44c89420270083de7d67b025748a4b98071ed
SHA256 b4f17e438636e166a94b2cd7c83e1c2b3cf1184122b6204521c1024e293ba8b1
SHA512 80f44373c7dc7a08d94b65e1f830e6d922ae9b8fefca5beadaf6a1a8c33622219da404bed11daeb7de03f1b3432782a11cd019ff814b981b9e6885066666affd

C:\Users\Admin\AppData\Roaming\{1BA8F424-A89D-88F1-16F4-42A663196520}\ahqowiackf2.dll

MD5 002c64d47bf8c0878ac8ec2b4740f682
SHA1 acc44c89420270083de7d67b025748a4b98071ed
SHA256 b4f17e438636e166a94b2cd7c83e1c2b3cf1184122b6204521c1024e293ba8b1
SHA512 80f44373c7dc7a08d94b65e1f830e6d922ae9b8fefca5beadaf6a1a8c33622219da404bed11daeb7de03f1b3432782a11cd019ff814b981b9e6885066666affd

memory/4852-13-0x000002348E0B0000-0x000002348E0FF000-memory.dmp

memory/4852-14-0x000002348FA00000-0x000002348FA4C000-memory.dmp

memory/4852-19-0x000002348FA00000-0x000002348FA4C000-memory.dmp

memory/4852-20-0x000002348FA00000-0x000002348FA4C000-memory.dmp

memory/4852-21-0x000002348E0B0000-0x000002348E0FF000-memory.dmp

memory/4852-24-0x000002348FA00000-0x000002348FA4C000-memory.dmp

memory/4852-25-0x000002348FA00000-0x000002348FA4C000-memory.dmp

memory/4852-27-0x000002348FA00000-0x000002348FA4C000-memory.dmp