icedid | 6e8783ce55907a849f9d8594db57c58d6eac717c7f5e4f8f52752898fe3f1d83

General

Target

1ba223ba6300c05c1e29105e519d884c2cebdbd1485838a46378c10dc77a8623.xll
Size

70KB
MD5

9ba7141f0a8d4840393af0230184dccd
SHA1

4c5a61203719c4fb3e64117a6c5e5980bd257802
SHA256

1ba223ba6300c05c1e29105e519d884c2cebdbd1485838a46378c10dc77a8623
SHA512

e2a857771574da00da240b84ad91b99d01cbe4fcf4dc0e7a592bce490752646a84e13010ed0523ce50891058cfdfd5cdc708660d4ad1b7184e43fd6056e1162d
SSDEEP

1536:MXUu709gnZgl7f/3jWCgiMthg8Mi3lHg9gIgmfgCjMiAOqTu/+vXWPbge96L94hH:Mw9eg5fPKCNAXMixmHBfFzmu/mAbgw1h

Score

10^/10

icedid 497724135 banker loader trojan

Malware Config

Extracted

Language

xlm4.0

Source

Extracted

Family

icedid

Campaign

497724135

C2

ovedfromasi.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4816	2032	rundll32.exe	83

Blocklisted process makes network request 1 IoCs

flow	pid	Process
20	4816	rundll32.exe

Loads dropped DLL 3 IoCs

pid	Process
2032	EXCEL.EXE
2032	EXCEL.EXE
4816	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2032	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4816	rundll32.exe
4816	rundll32.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2032	EXCEL.EXE
2032	EXCEL.EXE
2032	EXCEL.EXE
2032	EXCEL.EXE
2032	EXCEL.EXE
2032	EXCEL.EXE
2032	EXCEL.EXE
2032	EXCEL.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 4816	2032	EXCEL.EXE	86
PID 2032 wrote to memory of 4816	2032	EXCEL.EXE	86

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\1ba223ba6300c05c1e29105e519d884c2cebdbd1485838a46378c10dc77a8623.xll"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SYSTEM32\rundll32.exe
  rundll32 C:\Users\Admin\JetBrainsdotNex.dll , DllGetClassObject
  2⤵
  - Process spawned unexpected child process
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1ba223ba6300c05c1e29105e519d884c2cebdbd1485838a46378c10dc77a8623.xll

Filesize
70KB

MD5
9ba7141f0a8d4840393af0230184dccd

SHA1
4c5a61203719c4fb3e64117a6c5e5980bd257802

SHA256
1ba223ba6300c05c1e29105e519d884c2cebdbd1485838a46378c10dc77a8623

SHA512
e2a857771574da00da240b84ad91b99d01cbe4fcf4dc0e7a592bce490752646a84e13010ed0523ce50891058cfdfd5cdc708660d4ad1b7184e43fd6056e1162d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
5KB

MD5
973893ddb8028245e7169f6bc4c54c5f

SHA1
463e1097e5d6d01439ddfb55729493960a78aeb1

SHA256
48e9ef34d56f9114c8af81b771f8835a092af799fcaf9ce3ebf0f930119a0e4a

SHA512
339be8300337a84e002696ada31c3901bb0275a15121d8c69d65539261e1979c7c91057822a858471bc6a6fa435a60eb62e51ac0dc57c549ea6f0e2e47c322d4

Download Submit
C:\Users\Admin\JetBrainsdotNex.dll

Filesize
38KB

MD5
e0eb5ee1877137874ffa2da89ea711a4

SHA1
7be7d4eab05c0070ece0ca1e54b183829b227588

SHA256
33656b2710aa5d69afa7402f050b8f812923743f86a5bf4d1f22f8ce29be7179

SHA512
ca47e2a86edecffa9c6250d98750f7a49530dbea2bcff74678ab43d38410b2b3fdf8ea5b69bc656472ab3915fd225ff5ade64b3699d182075ed94155a56ec215

Download Submit
memory/2032-1-0x00007FFF69270000-0x00007FFF69280000-memory.dmp

Filesize
64KB

Download
memory/2032-10-0x00007FFFA8300000-0x00007FFFA842A000-memory.dmp

Filesize
1.2MB

Download
memory/2032-6-0x00007FFFA8300000-0x00007FFFA842A000-memory.dmp

Filesize
1.2MB

Download
memory/2032-5-0x00007FFFA8300000-0x00007FFFA842A000-memory.dmp

Filesize
1.2MB

Download
memory/2032-7-0x00007FFF66910000-0x00007FFF66920000-memory.dmp

Filesize
64KB

Download
memory/2032-8-0x00007FFFA8300000-0x00007FFFA842A000-memory.dmp

Filesize
1.2MB

Download
memory/2032-9-0x00007FFFA8300000-0x00007FFFA842A000-memory.dmp

Filesize
1.2MB

Download
memory/2032-0-0x00007FFF69270000-0x00007FFF69280000-memory.dmp

Filesize
64KB

Download
memory/2032-11-0x00007FFF66910000-0x00007FFF66920000-memory.dmp

Filesize
64KB

Download
memory/2032-4-0x00007FFF69270000-0x00007FFF69280000-memory.dmp

Filesize
64KB

Download
memory/2032-3-0x00007FFF69270000-0x00007FFF69280000-memory.dmp

Filesize
64KB

Download
memory/2032-2-0x00007FFF69270000-0x00007FFF69280000-memory.dmp

Filesize
64KB

Download
memory/2032-28-0x00007FFFA8300000-0x00007FFFA842A000-memory.dmp

Filesize
1.2MB

Download
memory/4816-27-0x00007FFFA8300000-0x00007FFFA842A000-memory.dmp

Filesize
1.2MB

Download
memory/4816-26-0x0000027783570000-0x00000277835D3000-memory.dmp

Filesize
396KB

Download
memory/4816-37-0x00007FFFA8300000-0x00007FFFA842A000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads