icedid | d5ffa565905837a1b14d5a00c44ef14bb429a907f7323f140583b69a69e5cdbe

General

Target

1648556.exe
Size

208KB
MD5

5b37fba9803604b8a79df4817d569456
SHA1

6bf01466ac467fabb8ef8b3575373d4d82012b6c
SHA256

d5ffa565905837a1b14d5a00c44ef14bb429a907f7323f140583b69a69e5cdbe
SHA512

c7ca4906f72ca0bbc9314c7eecc82ce355d94fd503ac94750a81cfb4fb2bb9c810753717af569bcad96633d8bd938919c1f0952bd55173cf6b95aa1d1cbc33f2
SSDEEP

3072:WMTNt2JlRRZuH5a3YTy371U4isTFXFG83+xdeILvqo+:zNt0ZuH5YYTy3RMcVkbbCN

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID Second Stage Loader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/2136-0-0x0000000000400000-0x00000000004F3000-memory.dmp	IcedidSecondLoader

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\04D73D1233B0D9117E2D6DEE0A4B50C5526D91FD	1648556.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\04D73D1233B0D9117E2D6DEE0A4B50C5526D91FD\Blob = 0f0000000100000020000000db2682d37074a5a98ebfae215c106d88633935f9d53140b48136527be2bf4fb203000000010000001400000004d73d1233b0d9117e2d6dee0a4b50c5526d91fd2000000001000000f9020000308202f5308201dda00302010202103b388b3caf7cf0742d84a103c68c02b9300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3233313231333138303030305a170d3238313231313138303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100c4052cbd9b871c01c975efc91a6a99c2b543de00881a0bd08e2a4143c5da04c224dcc4ba2010bab08603b2b8c3ea6283784dedeb6d15e5bb775a6a04a4a7b2eec7958d47a3aead8074b349b63361a23622d9227e180bf1db447739d27649aafcd86c86cd1851df1d1e2934039a59822a841c42e3c689b4a47843eb8386407fa76518f5fc3ebc61158c07957da48d4ea7ba0efdaa68e5844f2a38aa3d737f8343f869035e3aa98572230ae334ed2be6185465f33d099d1bf563db1882cb866c8dc59d62fa215d56af9c15b478c0598fbc82ecb6f07e49ea5c2342a3258c3ff71e4b6cdafc3cc0e0113e54dd2b82ec24b5b3367cab1331aafe951d109785991fcd0203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e0416041445c8b15b4c0c72f56da34c872403de5ab72a133a300d06092a864886f70d01010b05000382010100b34f968936438a440d78aeab3622c2bee6ed12c81530b6d71f2e234712569f9ef96aea5677b87e493bcc6e79762b24ff0231f2dfb849965464d561a02d65e578529af6d9738acc9fb0d6075be077ff13d3dfdea04e26c015523863c851dafbdac04ccafb348a1b47ba6c7751436818c162d65b321eac10b74892e2450e093746f1df21ca5b6784cc0ed71f2656a80ec97e7249b0f9bc8ff0a749042b359f195483aaacdea28501002b5d20ae7e00ad6a07f4f0fc66139d10efdf4e7753b94dab63fd212d7542b8527e249cab6321d8260e9c98e2cba9b0da544d97720dc1670cfd158a700b3acf28aa9d6bc1e8dca6c186c5f5612b84692429633e583332ccab	1648556.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\04D73D1233B0D9117E2D6DEE0A4B50C5526D91FD\Blob = 14000000010000001400000045c8b15b4c0c72f56da34c872403de5ab72a133a03000000010000001400000004d73d1233b0d9117e2d6dee0a4b50c5526d91fd0f0000000100000020000000db2682d37074a5a98ebfae215c106d88633935f9d53140b48136527be2bf4fb22000000001000000f9020000308202f5308201dda00302010202103b388b3caf7cf0742d84a103c68c02b9300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3233313231333138303030305a170d3238313231313138303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100c4052cbd9b871c01c975efc91a6a99c2b543de00881a0bd08e2a4143c5da04c224dcc4ba2010bab08603b2b8c3ea6283784dedeb6d15e5bb775a6a04a4a7b2eec7958d47a3aead8074b349b63361a23622d9227e180bf1db447739d27649aafcd86c86cd1851df1d1e2934039a59822a841c42e3c689b4a47843eb8386407fa76518f5fc3ebc61158c07957da48d4ea7ba0efdaa68e5844f2a38aa3d737f8343f869035e3aa98572230ae334ed2be6185465f33d099d1bf563db1882cb866c8dc59d62fa215d56af9c15b478c0598fbc82ecb6f07e49ea5c2342a3258c3ff71e4b6cdafc3cc0e0113e54dd2b82ec24b5b3367cab1331aafe951d109785991fcd0203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e0416041445c8b15b4c0c72f56da34c872403de5ab72a133a300d06092a864886f70d01010b05000382010100b34f968936438a440d78aeab3622c2bee6ed12c81530b6d71f2e234712569f9ef96aea5677b87e493bcc6e79762b24ff0231f2dfb849965464d561a02d65e578529af6d9738acc9fb0d6075be077ff13d3dfdea04e26c015523863c851dafbdac04ccafb348a1b47ba6c7751436818c162d65b321eac10b74892e2450e093746f1df21ca5b6784cc0ed71f2656a80ec97e7249b0f9bc8ff0a749042b359f195483aaacdea28501002b5d20ae7e00ad6a07f4f0fc66139d10efdf4e7753b94dab63fd212d7542b8527e249cab6321d8260e9c98e2cba9b0da544d97720dc1670cfd158a700b3acf28aa9d6bc1e8dca6c186c5f5612b84692429633e583332ccab	1648556.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\04D73D1233B0D9117E2D6DEE0A4B50C5526D91FD\Blob = 04000000010000001000000035f37364a3763bdd7853d9d27ec45d220f0000000100000020000000db2682d37074a5a98ebfae215c106d88633935f9d53140b48136527be2bf4fb203000000010000001400000004d73d1233b0d9117e2d6dee0a4b50c5526d91fd14000000010000001400000045c8b15b4c0c72f56da34c872403de5ab72a133a2000000001000000f9020000308202f5308201dda00302010202103b388b3caf7cf0742d84a103c68c02b9300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3233313231333138303030305a170d3238313231313138303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100c4052cbd9b871c01c975efc91a6a99c2b543de00881a0bd08e2a4143c5da04c224dcc4ba2010bab08603b2b8c3ea6283784dedeb6d15e5bb775a6a04a4a7b2eec7958d47a3aead8074b349b63361a23622d9227e180bf1db447739d27649aafcd86c86cd1851df1d1e2934039a59822a841c42e3c689b4a47843eb8386407fa76518f5fc3ebc61158c07957da48d4ea7ba0efdaa68e5844f2a38aa3d737f8343f869035e3aa98572230ae334ed2be6185465f33d099d1bf563db1882cb866c8dc59d62fa215d56af9c15b478c0598fbc82ecb6f07e49ea5c2342a3258c3ff71e4b6cdafc3cc0e0113e54dd2b82ec24b5b3367cab1331aafe951d109785991fcd0203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e0416041445c8b15b4c0c72f56da34c872403de5ab72a133a300d06092a864886f70d01010b05000382010100b34f968936438a440d78aeab3622c2bee6ed12c81530b6d71f2e234712569f9ef96aea5677b87e493bcc6e79762b24ff0231f2dfb849965464d561a02d65e578529af6d9738acc9fb0d6075be077ff13d3dfdea04e26c015523863c851dafbdac04ccafb348a1b47ba6c7751436818c162d65b321eac10b74892e2450e093746f1df21ca5b6784cc0ed71f2656a80ec97e7249b0f9bc8ff0a749042b359f195483aaacdea28501002b5d20ae7e00ad6a07f4f0fc66139d10efdf4e7753b94dab63fd212d7542b8527e249cab6321d8260e9c98e2cba9b0da544d97720dc1670cfd158a700b3acf28aa9d6bc1e8dca6c186c5f5612b84692429633e583332ccab	1648556.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\04D73D1233B0D9117E2D6DEE0A4B50C5526D91FD\Blob = 190000000100000010000000a6b30ae30c1adfc7079641479879fd3414000000010000001400000045c8b15b4c0c72f56da34c872403de5ab72a133a03000000010000001400000004d73d1233b0d9117e2d6dee0a4b50c5526d91fd0f0000000100000020000000db2682d37074a5a98ebfae215c106d88633935f9d53140b48136527be2bf4fb204000000010000001000000035f37364a3763bdd7853d9d27ec45d222000000001000000f9020000308202f5308201dda00302010202103b388b3caf7cf0742d84a103c68c02b9300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3233313231333138303030305a170d3238313231313138303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100c4052cbd9b871c01c975efc91a6a99c2b543de00881a0bd08e2a4143c5da04c224dcc4ba2010bab08603b2b8c3ea6283784dedeb6d15e5bb775a6a04a4a7b2eec7958d47a3aead8074b349b63361a23622d9227e180bf1db447739d27649aafcd86c86cd1851df1d1e2934039a59822a841c42e3c689b4a47843eb8386407fa76518f5fc3ebc61158c07957da48d4ea7ba0efdaa68e5844f2a38aa3d737f8343f869035e3aa98572230ae334ed2be6185465f33d099d1bf563db1882cb866c8dc59d62fa215d56af9c15b478c0598fbc82ecb6f07e49ea5c2342a3258c3ff71e4b6cdafc3cc0e0113e54dd2b82ec24b5b3367cab1331aafe951d109785991fcd0203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e0416041445c8b15b4c0c72f56da34c872403de5ab72a133a300d06092a864886f70d01010b05000382010100b34f968936438a440d78aeab3622c2bee6ed12c81530b6d71f2e234712569f9ef96aea5677b87e493bcc6e79762b24ff0231f2dfb849965464d561a02d65e578529af6d9738acc9fb0d6075be077ff13d3dfdea04e26c015523863c851dafbdac04ccafb348a1b47ba6c7751436818c162d65b321eac10b74892e2450e093746f1df21ca5b6784cc0ed71f2656a80ec97e7249b0f9bc8ff0a749042b359f195483aaacdea28501002b5d20ae7e00ad6a07f4f0fc66139d10efdf4e7753b94dab63fd212d7542b8527e249cab6321d8260e9c98e2cba9b0da544d97720dc1670cfd158a700b3acf28aa9d6bc1e8dca6c186c5f5612b84692429633e583332ccab	1648556.exe

C:\Users\Admin\AppData\Local\Temp\1648556.exe
"C:\Users\Admin\AppData\Local\Temp\1648556.exe"
1⤵
- Modifies system certificate store
PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2136-1-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2136-0-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download

Analysis

Sharing