Analysis

  • max time kernel
    128s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-10-2023 09:54

General

  • Target

    86bcd250b70e261d29a20538ffaf9ea3b27b510f02721cc6853bda227deeb118.msi

  • Size

    988KB

  • MD5

    32ee17c4caae3570e290c8a653aa380f

  • SHA1

    3b6ffb4fe23aa45ab536486f1aa11e02fac520b3

  • SHA256

    86bcd250b70e261d29a20538ffaf9ea3b27b510f02721cc6853bda227deeb118

  • SHA512

    059e383c954f97993bfbef9f161fe8548d52b9814b0f481d245209f9e7388c2a5aeb38b404353279dec892d20f64b96407ce37b46cf0d2362cc78a4b4482d530

  • SSDEEP

    12288:dBlIPDf7JnfcMwbNlquDsGnTFJT+XXW12MJkuTTBZZO2LKHL0vK++KA20n:dBlIGM8ou4GrToG12BoDZoL07+KAD

Malware Config

Extracted

Family

icedid

Campaign

879983162

C2

aptekoagraliy.com

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\86bcd250b70e261d29a20538ffaf9ea3b27b510f02721cc6853bda227deeb118.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4688
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4104
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4984
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 1D1E7BCE85AA5622CE4119D5814B6346
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4776
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI5D10.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240672062 2 test.cs!X1X3X2.Y1yY.Z3z1Z
          3⤵
          • Checks computer location settings
          • Loads dropped DLL
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:2796
          • C:\Windows\System32\rundll32.exe
            "C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\MSI6fea4fcc.msi",scab /k jeeps329
            4⤵
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            PID:2708
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4780

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e585a80.rbs

      Filesize

      8KB

      MD5

      b9a8bcf456153c0fc5cc9600920425f2

      SHA1

      5dd9e87a9c9c777a8f015e0750b6e7fe8bc76bb5

      SHA256

      610ed4bc5bc1f887e45f3c76b0ee487cb0df6bb052b09cf6914e0f1504ddb90c

      SHA512

      db14ab8bcf10aecc540ae7a21dc43c89d401d0ba2d909c5275b0092eed7f57a320ed97574c8f7e78b6d4cb4e7748ad67ac219f09154ed6049233689001dba48e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C42BC945025A34066DAB76EF3F80A05

      Filesize

      40KB

      MD5

      c62f298eaa04686d0379e6cebe8d7328

      SHA1

      f28c579242720bc38aa66196b63c4b518b11069d

      SHA256

      89cf5e48a19925908f4433a15f6e7be08c62e58063ca65ea9dc3b1c1d4107a73

      SHA512

      973bdf81459a7b6883435d47d064c18a7300005a74511ab63bda79687def6a0b5b10acc51b77ab3d77b9b09a7cd62a249bb58fe04467c074c33f95a6a66b4e74

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1

      Filesize

      727B

      MD5

      4e25d0434bd1f6cf35ee2c332255e571

      SHA1

      95a58811cbde3a2513d7fb8210e79545d45b8ab4

      SHA256

      8bc805fff18eda3d49a908d49f5659c07231e5bf0f4508019624b38a385a90f9

      SHA512

      09ef92c3f49ea82800bcd0b4fdcb6d7a5e559c9dad9bbdda139cbabef08907b89234026ece34f47e5626d5f56103220ac907ceda3c63b7eaab8933acbcf02e23

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C42BC945025A34066DAB76EF3F80A05

      Filesize

      314B

      MD5

      61a12aadbcf2965ce83f62518a4d2435

      SHA1

      d9452c26c46f8d10a482e28f7d76bc8d322a2692

      SHA256

      eb57d137a353c6875ee2860305fd69494f100e13b51d1b36d0b3e40eb4a296f5

      SHA512

      999eaeab32787860bf5415272d07a0b1111b6671cf3e97c4bfd22d6828093d71e73ef3e42a5d9e76cc8dc319131caf9c58e81f781ae1bb976070f7defdf6ccca

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1

      Filesize

      478B

      MD5

      3434136869b1d155f86753e76027057b

      SHA1

      49392522577dc34687be46dc16be1ab8b33ebbd6

      SHA256

      a64a0c72ee1ff78205186950fd6bb7ea254149509910915a0069f19f0f94e7d8

      SHA512

      ce8343856bbcadb13b7e1ca40aa3e2e5e6753c9936ad447c8932ed976a28fe9d0bd4c20ecad2dbe6ac97b3b3f770d1c7fabf267a43260cf9dd5e3f91f3dced7d

    • C:\Users\Admin\AppData\Local\MSI6fea4fcc.msi

      Filesize

      529KB

      MD5

      c00a7a0dc633b124eb26504cc7c89d60

      SHA1

      87e75c6f66d515a53e7a7690f8add5ed3b4e539c

      SHA256

      56828f5666370fd228b33e3f81001d7cdeffdd7643d566bbb01f7a5b29728838

      SHA512

      54add2802c7268c03297640b0440b1f59c867dddec5332e663fce65a3c3624564452187264491c14cdfd81c0aa3367646868cbc791dc168fa84cbb33ea980975

    • C:\Users\Admin\AppData\Local\MSI6fea4fcc.msi

      Filesize

      529KB

      MD5

      c00a7a0dc633b124eb26504cc7c89d60

      SHA1

      87e75c6f66d515a53e7a7690f8add5ed3b4e539c

      SHA256

      56828f5666370fd228b33e3f81001d7cdeffdd7643d566bbb01f7a5b29728838

      SHA512

      54add2802c7268c03297640b0440b1f59c867dddec5332e663fce65a3c3624564452187264491c14cdfd81c0aa3367646868cbc791dc168fa84cbb33ea980975

    • C:\Windows\Installer\MSI5D10.tmp

      Filesize

      408KB

      MD5

      c7e405100714c4c686a256220e59f306

      SHA1

      b67b2c517ecf29b2fbf17a32040d73a1362db884

      SHA256

      471b54fd2b74ce73f41e4fe9ac6c459eba9d8d06c2448fe7097c58e5d8ea04fa

      SHA512

      b7633fd54f60cb41a5a8ecd4b52dad3e767b6babfebb905af7c14f63a8f082b072d8d814defe23b46bdcdfb878b7dd52bd9634b448b59c8b870b69e7bd5a8832

    • C:\Windows\Installer\MSI5D10.tmp

      Filesize

      408KB

      MD5

      c7e405100714c4c686a256220e59f306

      SHA1

      b67b2c517ecf29b2fbf17a32040d73a1362db884

      SHA256

      471b54fd2b74ce73f41e4fe9ac6c459eba9d8d06c2448fe7097c58e5d8ea04fa

      SHA512

      b7633fd54f60cb41a5a8ecd4b52dad3e767b6babfebb905af7c14f63a8f082b072d8d814defe23b46bdcdfb878b7dd52bd9634b448b59c8b870b69e7bd5a8832

    • C:\Windows\Installer\MSI5D10.tmp

      Filesize

      408KB

      MD5

      c7e405100714c4c686a256220e59f306

      SHA1

      b67b2c517ecf29b2fbf17a32040d73a1362db884

      SHA256

      471b54fd2b74ce73f41e4fe9ac6c459eba9d8d06c2448fe7097c58e5d8ea04fa

      SHA512

      b7633fd54f60cb41a5a8ecd4b52dad3e767b6babfebb905af7c14f63a8f082b072d8d814defe23b46bdcdfb878b7dd52bd9634b448b59c8b870b69e7bd5a8832

    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

      Filesize

      23.0MB

      MD5

      0a75b4532666bba2dac31ed9789175f2

      SHA1

      6b32add25ee9ab9359c8e7e0fd7143b071c76558

      SHA256

      e4b3a0595b70ab95a35f6b32094b7a1aeae5c98c737516d745b491b571b9c769

      SHA512

      4cec4ee873b80ce63fa411edce9482909756cef5b719890788364d6de76cbee7c262b396a56e8f6455c0c7d4419a516ba1c914066799eb080cf05f6e15a7314f

    • \??\Volume{6ada6bfc-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{56c3621d-69fd-4b3f-8302-c362eafa4faa}_OnDiskSnapshotProp

      Filesize

      5KB

      MD5

      cb735ecf41ecfd16f02131ea466d431e

      SHA1

      26404683fdf11da244452ced847012775e6a6117

      SHA256

      85fef17a672105d751eec97061ef0f5bb03fd2b373f38562b77a992e39243314

      SHA512

      34e295b30d17c8924a9c7623e136fa2aa020102cf638170f2633e1ed4786a1621050e9ee58de99ddc47ce98e197dec59907864c1250f5a89197d9661e31fb53b

    • memory/2708-70-0x0000020A47570000-0x0000020A47574000-memory.dmp

      Filesize

      16KB

    • memory/2796-52-0x000001A85A060000-0x000001A85A070000-memory.dmp

      Filesize

      64KB

    • memory/2796-54-0x000001A85A060000-0x000001A85A070000-memory.dmp

      Filesize

      64KB

    • memory/2796-55-0x000001A85A060000-0x000001A85A070000-memory.dmp

      Filesize

      64KB

    • memory/2796-53-0x000001A85A060000-0x000001A85A070000-memory.dmp

      Filesize

      64KB

    • memory/2796-51-0x00007FFE44FF0000-0x00007FFE45AB1000-memory.dmp

      Filesize

      10.8MB

    • memory/2796-68-0x00007FFE44FF0000-0x00007FFE45AB1000-memory.dmp

      Filesize

      10.8MB

    • memory/2796-50-0x000001A85A0E0000-0x000001A85A150000-memory.dmp

      Filesize

      448KB

    • memory/2796-48-0x000001A841B20000-0x000001A841B2A000-memory.dmp

      Filesize

      40KB

    • memory/2796-46-0x000001A859FD0000-0x000001A859FFE000-memory.dmp

      Filesize

      184KB

    • memory/3304-73-0x00007FFE63D81000-0x00007FFE63D82000-memory.dmp

      Filesize

      4KB

    • memory/3304-74-0x0000000180000000-0x0000000180009000-memory.dmp

      Filesize

      36KB

    • memory/3304-81-0x0000000180000000-0x0000000180009000-memory.dmp

      Filesize

      36KB

    • memory/3304-84-0x00007FFE63D81000-0x00007FFE63D82000-memory.dmp

      Filesize

      4KB