icedid | 17c93b8c39237e477d26462af05457a2c5402d736368183d0e38a6b19dea6d44

General

Target

e4fdc8b6743a24bcb75957fc1c2591dd552637e33184affe233f2ec7aa694225.xll
Size

70KB
MD5

3b997ceaae98ea79e64717c1223b03b2
SHA1

8e5f7f54cf8e1f8d2615d70dd60e8a2cdf9108cf
SHA256

e4fdc8b6743a24bcb75957fc1c2591dd552637e33184affe233f2ec7aa694225
SHA512

0d0ebac10b3c83e25086c2e7417b81fc19e803acf1c79dd7732b320b70ec2091d261001c98e8b1bc3bb1b4121fcb009a00f96c5edd307d4bd8b1eda9da037319
SSDEEP

1536:bXUu709gnZkl7f/3jWCgiMthg8Mi3lHg9gIgmfgCjMiAOqTu/+vXWPbge96LM4hH:bw9ek5fPKCNAXMixmHBfFzmu/mAbgw2h

Score

10^/10

icedid 497724135 banker loader trojan

Malware Config

Extracted

Language

xlm4.0

Source

Extracted

Family

icedid

Campaign

497724135

C2

ovedfromasi.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4800	4080	rundll32.exe	81

Blocklisted process makes network request 1 IoCs

flow	pid	Process
18	4800	rundll32.exe

Loads dropped DLL 3 IoCs

pid	Process
4080	EXCEL.EXE
4080	EXCEL.EXE
4800	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4080	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4800	rundll32.exe
4800	rundll32.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4080	EXCEL.EXE
4080	EXCEL.EXE
4080	EXCEL.EXE
4080	EXCEL.EXE
4080	EXCEL.EXE
4080	EXCEL.EXE
4080	EXCEL.EXE
4080	EXCEL.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 4800	4080	EXCEL.EXE	83
PID 4080 wrote to memory of 4800	4080	EXCEL.EXE	83

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e4fdc8b6743a24bcb75957fc1c2591dd552637e33184affe233f2ec7aa694225.xll"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\SYSTEM32\rundll32.exe
  rundll32 C:\Users\Admin\JetBrainsdotNec.dll , DllGetClassObject
  2⤵
  - Process spawned unexpected child process
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e4fdc8b6743a24bcb75957fc1c2591dd552637e33184affe233f2ec7aa694225.xll

Filesize
70KB

MD5
3b997ceaae98ea79e64717c1223b03b2

SHA1
8e5f7f54cf8e1f8d2615d70dd60e8a2cdf9108cf

SHA256
e4fdc8b6743a24bcb75957fc1c2591dd552637e33184affe233f2ec7aa694225

SHA512
0d0ebac10b3c83e25086c2e7417b81fc19e803acf1c79dd7732b320b70ec2091d261001c98e8b1bc3bb1b4121fcb009a00f96c5edd307d4bd8b1eda9da037319

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
3KB

MD5
a79c2f86f599c5ed95cbe756abfd4f61

SHA1
718305a79e293b5b4b7610fd7e9714ef382e70bd

SHA256
b9f9a34b0465683ea05c91509246da4179e7603c34fef8dc824650d65e792049

SHA512
06e03bc66c288f7b1671b9fee156e246a3d98fcb68733dbdd3042f56a984fe36319bbc9a93707683aed580c9cfda09d27eeeaefee4c8c84d1560cd1fb969b548

Download Submit
C:\Users\Admin\JetBrainsdotNec.dll

Filesize
38KB

MD5
e0eb5ee1877137874ffa2da89ea711a4

SHA1
7be7d4eab05c0070ece0ca1e54b183829b227588

SHA256
33656b2710aa5d69afa7402f050b8f812923743f86a5bf4d1f22f8ce29be7179

SHA512
ca47e2a86edecffa9c6250d98750f7a49530dbea2bcff74678ab43d38410b2b3fdf8ea5b69bc656472ab3915fd225ff5ade64b3699d182075ed94155a56ec215

Download Submit
memory/4080-17-0x00007FFB15DD0000-0x00007FFB15DE0000-memory.dmp

Filesize
64KB

Download
memory/4080-11-0x00007FFB57DB0000-0x00007FFB57FA5000-memory.dmp

Filesize
2.0MB

Download
memory/4080-7-0x00007FFB57DB0000-0x00007FFB57FA5000-memory.dmp

Filesize
2.0MB

Download
memory/4080-6-0x00007FFB57DB0000-0x00007FFB57FA5000-memory.dmp

Filesize
2.0MB

Download
memory/4080-4-0x00007FFB17E30000-0x00007FFB17E40000-memory.dmp

Filesize
64KB

Download
memory/4080-10-0x00007FFB57DB0000-0x00007FFB57FA5000-memory.dmp

Filesize
2.0MB

Download
memory/4080-13-0x00007FFB57DB0000-0x00007FFB57FA5000-memory.dmp

Filesize
2.0MB

Download
memory/4080-12-0x00007FFB57DB0000-0x00007FFB57FA5000-memory.dmp

Filesize
2.0MB

Download
memory/4080-15-0x00007FFB57DB0000-0x00007FFB57FA5000-memory.dmp

Filesize
2.0MB

Download
memory/4080-16-0x00007FFB15DD0000-0x00007FFB15DE0000-memory.dmp

Filesize
64KB

Download
memory/4080-14-0x00007FFB57DB0000-0x00007FFB57FA5000-memory.dmp

Filesize
2.0MB

Download
memory/4080-0-0x00007FFB17E30000-0x00007FFB17E40000-memory.dmp

Filesize
64KB

Download
memory/4080-18-0x00007FFB57DB0000-0x00007FFB57FA5000-memory.dmp

Filesize
2.0MB

Download
memory/4080-5-0x00007FFB17E30000-0x00007FFB17E40000-memory.dmp

Filesize
64KB

Download
memory/4080-9-0x00007FFB57DB0000-0x00007FFB57FA5000-memory.dmp

Filesize
2.0MB

Download
memory/4080-8-0x00007FFB57DB0000-0x00007FFB57FA5000-memory.dmp

Filesize
2.0MB

Download
memory/4080-3-0x00007FFB17E30000-0x00007FFB17E40000-memory.dmp

Filesize
64KB

Download
memory/4080-2-0x00007FFB17E30000-0x00007FFB17E40000-memory.dmp

Filesize
64KB

Download
memory/4080-1-0x00007FFB57E4D000-0x00007FFB57E4E000-memory.dmp

Filesize
4KB

Download
memory/4080-37-0x00007FFB57DB0000-0x00007FFB57FA5000-memory.dmp

Filesize
2.0MB

Download
memory/4080-35-0x00007FFB57DB0000-0x00007FFB57FA5000-memory.dmp

Filesize
2.0MB

Download
memory/4080-36-0x00007FFB57E4D000-0x00007FFB57E4E000-memory.dmp

Filesize
4KB

Download
memory/4800-31-0x00007FFB57DB0000-0x00007FFB57FA5000-memory.dmp

Filesize
2.0MB

Download
memory/4800-30-0x0000019B9C1A0000-0x0000019B9C203000-memory.dmp

Filesize
396KB

Download
memory/4800-46-0x00007FFB57DB0000-0x00007FFB57FA5000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads