Analysis

  • max time kernel
    258s
  • max time network
    276s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-10-2023 06:31

General

  • Target

    build-065.msi

  • Size

    988KB

  • MD5

    32ee17c4caae3570e290c8a653aa380f

  • SHA1

    3b6ffb4fe23aa45ab536486f1aa11e02fac520b3

  • SHA256

    86bcd250b70e261d29a20538ffaf9ea3b27b510f02721cc6853bda227deeb118

  • SHA512

    059e383c954f97993bfbef9f161fe8548d52b9814b0f481d245209f9e7388c2a5aeb38b404353279dec892d20f64b96407ce37b46cf0d2362cc78a4b4482d530

  • SSDEEP

    12288:dBlIPDf7JnfcMwbNlquDsGnTFJT+XXW12MJkuTTBZZO2LKHL0vK++KA20n:dBlIGM8ou4GrToG12BoDZoL07+KAD

Malware Config

Extracted

Family

icedid

Campaign

879983162

C2

aptekoagraliy.com

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\build-065.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3776
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1436
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3380
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 1022F77ED03CF9B4E6EC8AD4B41193AD
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:492
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI480.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240649468 2 test.cs!X1X3X2.Y1yY.Z3z1Z
          3⤵
          • Checks computer location settings
          • Loads dropped DLL
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:4064
          • C:\Windows\System32\rundll32.exe
            "C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\MSI7129410a.msi",scab /k jeeps329
            4⤵
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            PID:4176
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:1896
    • C:\Windows\System32\Upfc.exe
      C:\Windows\System32\Upfc.exe /launchtype periodic /cv do0e20iekE6OIcoP1tPrEA.0
      1⤵
        PID:2004
      • C:\Windows\system32\rundll32.exe
        C:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask
        1⤵
          PID:2180

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C42BC945025A34066DAB76EF3F80A05

          Filesize

          40KB

          MD5

          c62f298eaa04686d0379e6cebe8d7328

          SHA1

          f28c579242720bc38aa66196b63c4b518b11069d

          SHA256

          89cf5e48a19925908f4433a15f6e7be08c62e58063ca65ea9dc3b1c1d4107a73

          SHA512

          973bdf81459a7b6883435d47d064c18a7300005a74511ab63bda79687def6a0b5b10acc51b77ab3d77b9b09a7cd62a249bb58fe04467c074c33f95a6a66b4e74

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1

          Filesize

          727B

          MD5

          4e25d0434bd1f6cf35ee2c332255e571

          SHA1

          95a58811cbde3a2513d7fb8210e79545d45b8ab4

          SHA256

          8bc805fff18eda3d49a908d49f5659c07231e5bf0f4508019624b38a385a90f9

          SHA512

          09ef92c3f49ea82800bcd0b4fdcb6d7a5e559c9dad9bbdda139cbabef08907b89234026ece34f47e5626d5f56103220ac907ceda3c63b7eaab8933acbcf02e23

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C42BC945025A34066DAB76EF3F80A05

          Filesize

          314B

          MD5

          bbc2e43f834c7a0f1d02d7bdeac82e47

          SHA1

          82fddc3f784e7345a7058f6ce0bf7dc16f2c6e92

          SHA256

          00b3e6f7957f24e67ebc85898d8cec8d5ed64cb7374c25b45f40fe48cdfca437

          SHA512

          17eb7a17641fffa3d8f6bbdcc753704a41748d9aa0b46ac179dfa7f0c0461d8e27e062740658a07ef2525b6d01a80a4a65937a5d5537153433be11e64aaf5f7c

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1

          Filesize

          478B

          MD5

          e74fc52367d57289787263aa1117c325

          SHA1

          2ac9070710affaeaefaabf36c2e0e569ad0116ba

          SHA256

          7270458a2dea22ce9b01dd11f6302df36b561c8736de593a990c493bf79672b8

          SHA512

          781ca0a56bac889a2a9d78620c8cafa2adc3a431f3f0fe024394bd3590a3b44789207834f879987e813435e39f1f3c93a2eba38a029ebd9718376ee6c6549f9e

        • C:\Users\Admin\AppData\Local\MSI7129410a.msi

          Filesize

          529KB

          MD5

          c00a7a0dc633b124eb26504cc7c89d60

          SHA1

          87e75c6f66d515a53e7a7690f8add5ed3b4e539c

          SHA256

          56828f5666370fd228b33e3f81001d7cdeffdd7643d566bbb01f7a5b29728838

          SHA512

          54add2802c7268c03297640b0440b1f59c867dddec5332e663fce65a3c3624564452187264491c14cdfd81c0aa3367646868cbc791dc168fa84cbb33ea980975

        • C:\Users\Admin\AppData\Local\MSI7129410a.msi

          Filesize

          529KB

          MD5

          c00a7a0dc633b124eb26504cc7c89d60

          SHA1

          87e75c6f66d515a53e7a7690f8add5ed3b4e539c

          SHA256

          56828f5666370fd228b33e3f81001d7cdeffdd7643d566bbb01f7a5b29728838

          SHA512

          54add2802c7268c03297640b0440b1f59c867dddec5332e663fce65a3c3624564452187264491c14cdfd81c0aa3367646868cbc791dc168fa84cbb33ea980975

        • C:\Windows\Installer\MSI480.tmp

          Filesize

          408KB

          MD5

          c7e405100714c4c686a256220e59f306

          SHA1

          b67b2c517ecf29b2fbf17a32040d73a1362db884

          SHA256

          471b54fd2b74ce73f41e4fe9ac6c459eba9d8d06c2448fe7097c58e5d8ea04fa

          SHA512

          b7633fd54f60cb41a5a8ecd4b52dad3e767b6babfebb905af7c14f63a8f082b072d8d814defe23b46bdcdfb878b7dd52bd9634b448b59c8b870b69e7bd5a8832

        • C:\Windows\Installer\MSI480.tmp

          Filesize

          408KB

          MD5

          c7e405100714c4c686a256220e59f306

          SHA1

          b67b2c517ecf29b2fbf17a32040d73a1362db884

          SHA256

          471b54fd2b74ce73f41e4fe9ac6c459eba9d8d06c2448fe7097c58e5d8ea04fa

          SHA512

          b7633fd54f60cb41a5a8ecd4b52dad3e767b6babfebb905af7c14f63a8f082b072d8d814defe23b46bdcdfb878b7dd52bd9634b448b59c8b870b69e7bd5a8832

        • C:\Windows\Installer\MSI480.tmp

          Filesize

          408KB

          MD5

          c7e405100714c4c686a256220e59f306

          SHA1

          b67b2c517ecf29b2fbf17a32040d73a1362db884

          SHA256

          471b54fd2b74ce73f41e4fe9ac6c459eba9d8d06c2448fe7097c58e5d8ea04fa

          SHA512

          b7633fd54f60cb41a5a8ecd4b52dad3e767b6babfebb905af7c14f63a8f082b072d8d814defe23b46bdcdfb878b7dd52bd9634b448b59c8b870b69e7bd5a8832

        • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

          Filesize

          23.0MB

          MD5

          98f494225e39e58a0a839aec7b955725

          SHA1

          a561988fd2b47d8f66887ef4df5c86e90c0c2080

          SHA256

          610a76f40209f07e5566626285ccea58a69884d5a16906d2275411124797f5dd

          SHA512

          3018967e4a8084150b86740e236366399df5096d7a728d7ddbca91c57092554ec33a40aee8936d240d4e15beb1aace4076904cc9f816a7efaabed0a4e3da802f

        • \??\Volume{6814a8cd-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{573857a9-a17d-44b2-b678-d666ac86ab17}_OnDiskSnapshotProp

          Filesize

          5KB

          MD5

          4922c5c23b725ea0e6e6fd63d38afa25

          SHA1

          de5798867b1e2a17252b776e61f59c8393b09244

          SHA256

          f8c835b632ab212908c07b1c75944c841fcfd150e5ffa8750634480ab3acecc5

          SHA512

          df96d425a4a9245daa101fcbda00245354f32ddbc7862b67f5f420e13c78472bb07f076be7f987caa1e58ed99576394029fc24538db33da0915e0fb95f3603d7

        • memory/3280-78-0x0000000180000000-0x0000000180009000-memory.dmp

          Filesize

          36KB

        • memory/3280-71-0x0000000180000000-0x0000000180009000-memory.dmp

          Filesize

          36KB

        • memory/3280-70-0x00007FF8FD981000-0x00007FF8FD982000-memory.dmp

          Filesize

          4KB

        • memory/3280-81-0x00007FF8FD981000-0x00007FF8FD982000-memory.dmp

          Filesize

          4KB

        • memory/4064-50-0x000001F2AC9E0000-0x000001F2AC9F0000-memory.dmp

          Filesize

          64KB

        • memory/4064-52-0x000001F2AC9E0000-0x000001F2AC9F0000-memory.dmp

          Filesize

          64KB

        • memory/4064-65-0x00007FF8DE780000-0x00007FF8DF241000-memory.dmp

          Filesize

          10.8MB

        • memory/4064-51-0x000001F2AC9E0000-0x000001F2AC9F0000-memory.dmp

          Filesize

          64KB

        • memory/4064-49-0x000001F2AC9E0000-0x000001F2AC9F0000-memory.dmp

          Filesize

          64KB

        • memory/4064-47-0x000001F2AD4E0000-0x000001F2AD550000-memory.dmp

          Filesize

          448KB

        • memory/4064-48-0x00007FF8DE780000-0x00007FF8DF241000-memory.dmp

          Filesize

          10.8MB

        • memory/4064-45-0x000001F294600000-0x000001F29460A000-memory.dmp

          Filesize

          40KB

        • memory/4064-43-0x000001F2AC990000-0x000001F2AC9BE000-memory.dmp

          Filesize

          184KB

        • memory/4176-69-0x000001C63EA70000-0x000001C63EA74000-memory.dmp

          Filesize

          16KB