Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19-12-2024 14:26

General

  • Target

    2024-12-19_72665429ba495c6e3f8c538a1346206e_icedid.exe

  • Size

    608KB

  • MD5

    72665429ba495c6e3f8c538a1346206e

  • SHA1

    acfdcd87e4664474ec43c309b964a8f2716eaadd

  • SHA256

    0327fd36fe504244476aa3ed1bcb21b4d030196bf0404334020d871aa1ee06c0

  • SHA512

    afb0a9edad3824c2cb5dc287d1b9411d67563b7aeef6d223f54709baddd04f663a8f1407f14cfcb2fc06f3941ca2408cbc027d8d3b04df16e4eb375aa3ef6232

  • SSDEEP

    12288:D/211RfBpEg42IRo0wk5bHAW+J+gNs5cVEMmt6BpB/:jwEgcRRgpVEMjrB/

Malware Config

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot family
  • Trickbot x86 loader 8 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-19_72665429ba495c6e3f8c538a1346206e_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-19_72665429ba495c6e3f8c538a1346206e_icedid.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2336
    • C:\Users\Admin\AppData\Roaming\speedlink\2024-12-19_92887429ba497c8e3f8c738a1348208e_icedid.exe
      C:\Users\Admin\AppData\Roaming\speedlink\2024-12-19_92887429ba497c8e3f8c738a1348208e_icedid.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2912
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:1780
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {A468D5AE-A444-44B3-9832-6C24E094F478} S-1-5-18:NT AUTHORITY\System:Service:
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2520
      • C:\Users\Admin\AppData\Roaming\speedlink\2024-12-19_92887429ba497c8e3f8c738a1348208e_icedid.exe
        C:\Users\Admin\AppData\Roaming\speedlink\2024-12-19_92887429ba497c8e3f8c738a1348208e_icedid.exe
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2932
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe
          3⤵
            PID:2332

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \Users\Admin\AppData\Roaming\speedlink\2024-12-19_92887429ba497c8e3f8c738a1348208e_icedid.exe

        Filesize

        608KB

        MD5

        72665429ba495c6e3f8c538a1346206e

        SHA1

        acfdcd87e4664474ec43c309b964a8f2716eaadd

        SHA256

        0327fd36fe504244476aa3ed1bcb21b4d030196bf0404334020d871aa1ee06c0

        SHA512

        afb0a9edad3824c2cb5dc287d1b9411d67563b7aeef6d223f54709baddd04f663a8f1407f14cfcb2fc06f3941ca2408cbc027d8d3b04df16e4eb375aa3ef6232

      • memory/1780-17-0x0000000000060000-0x0000000000080000-memory.dmp

        Filesize

        128KB

      • memory/1780-18-0x0000000000060000-0x0000000000080000-memory.dmp

        Filesize

        128KB

      • memory/2332-29-0x0000000000060000-0x0000000000080000-memory.dmp

        Filesize

        128KB

      • memory/2332-28-0x0000000000060000-0x0000000000080000-memory.dmp

        Filesize

        128KB

      • memory/2336-19-0x00000000003B0000-0x00000000003DE000-memory.dmp

        Filesize

        184KB

      • memory/2336-4-0x00000000003B0000-0x00000000003DE000-memory.dmp

        Filesize

        184KB

      • memory/2336-3-0x0000000000270000-0x000000000029D000-memory.dmp

        Filesize

        180KB

      • memory/2336-0-0x00000000003B0000-0x00000000003DE000-memory.dmp

        Filesize

        184KB

      • memory/2912-14-0x00000000003B0000-0x00000000003DE000-memory.dmp

        Filesize

        184KB

      • memory/2912-20-0x00000000003B0000-0x00000000003DE000-memory.dmp

        Filesize

        184KB

      • memory/2912-15-0x00000000004A0000-0x00000000004A1000-memory.dmp

        Filesize

        4KB

      • memory/2912-16-0x0000000010000000-0x0000000010005000-memory.dmp

        Filesize

        20KB

      • memory/2932-25-0x00000000007E0000-0x000000000080E000-memory.dmp

        Filesize

        184KB

      • memory/2932-27-0x0000000010000000-0x0000000010005000-memory.dmp

        Filesize

        20KB

      • memory/2932-26-0x0000000000810000-0x0000000000811000-memory.dmp

        Filesize

        4KB

      • memory/2932-30-0x00000000007E0000-0x000000000080E000-memory.dmp

        Filesize

        184KB