icedid | 77f3784b57f565a77044d5ae2cf7d1a1b5d23310f11a11b10092ad6cd573ae20

General

Target

d1e61f9b080e3b6892df3660c346870ec62ce7627437bc666d7e369e215f5f43.xll
Size

70KB
MD5

9fc21e4ab45c411b8251d493963608f3
SHA1

e0f7283f01221c9f54a2aff23bd426340bd00550
SHA256

d1e61f9b080e3b6892df3660c346870ec62ce7627437bc666d7e369e215f5f43
SHA512

03a6f8d64f2bbc0048d4bc00f3bc28b72ff1109cbf0cd5ed401ca6a893225f4b5fc51a7dd495ffb43f2aac2b378e77685b346c523219ca3173cc396913a60793
SSDEEP

1536:IXUu709gnZwl7f/3jWCgiMthg8Mi3lHg9gIgmfgCjMiAOqTu/+vXWPbge96LJ4hH:Iw9ew5fPKCNAXMixmHBfFzmu/mAbgwhh

Score

10^/10

icedid 497724135 banker loader trojan

Malware Config

Extracted

Language

xlm4.0

Source

Extracted

Family

icedid

Campaign

497724135

C2

ovedfromasi.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2368	3036	rundll32.exe	83

Blocklisted process makes network request 1 IoCs

flow	pid	Process
25	2368	rundll32.exe

Loads dropped DLL 3 IoCs

pid	Process
3036	EXCEL.EXE
3036	EXCEL.EXE
2368	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3036	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2368	rundll32.exe
2368	rundll32.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3036	EXCEL.EXE
3036	EXCEL.EXE
3036	EXCEL.EXE
3036	EXCEL.EXE
3036	EXCEL.EXE
3036	EXCEL.EXE
3036	EXCEL.EXE
3036	EXCEL.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2368	3036	EXCEL.EXE	86
PID 3036 wrote to memory of 2368	3036	EXCEL.EXE	86

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d1e61f9b080e3b6892df3660c346870ec62ce7627437bc666d7e369e215f5f43.xll"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SYSTEM32\rundll32.exe
  rundll32 C:\Users\Admin\JetBrainsdotNef.dll , DllGetClassObject
  2⤵
  - Process spawned unexpected child process
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d1e61f9b080e3b6892df3660c346870ec62ce7627437bc666d7e369e215f5f43.xll

Filesize
70KB

MD5
9fc21e4ab45c411b8251d493963608f3

SHA1
e0f7283f01221c9f54a2aff23bd426340bd00550

SHA256
d1e61f9b080e3b6892df3660c346870ec62ce7627437bc666d7e369e215f5f43

SHA512
03a6f8d64f2bbc0048d4bc00f3bc28b72ff1109cbf0cd5ed401ca6a893225f4b5fc51a7dd495ffb43f2aac2b378e77685b346c523219ca3173cc396913a60793

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
5KB

MD5
70ce6523c03f1eb5f3a73dfeb420ef0b

SHA1
fcfbce851d64ffe619121d8d102ad7e16cc46d96

SHA256
6e292ff4d70880cec9f71a791ca3524b9553d7256da75c2a35ee6981ec252e52

SHA512
9d87c71e6890149aa4b39fe8c0ee56ac94933f2e0cc1ee30ac556128b139dd588314cf1c9cffadbbbf6f1e087b519951bab12b365af8d14f73f743f8cbdac185

Download Submit
C:\Users\Admin\JetBrainsdotNef.dll

Filesize
38KB

MD5
e0eb5ee1877137874ffa2da89ea711a4

SHA1
7be7d4eab05c0070ece0ca1e54b183829b227588

SHA256
33656b2710aa5d69afa7402f050b8f812923743f86a5bf4d1f22f8ce29be7179

SHA512
ca47e2a86edecffa9c6250d98750f7a49530dbea2bcff74678ab43d38410b2b3fdf8ea5b69bc656472ab3915fd225ff5ade64b3699d182075ed94155a56ec215

Download Submit
memory/2368-44-0x00007FFFA91F0000-0x00007FFFA93E5000-memory.dmp

Filesize
2.0MB

Download
memory/2368-35-0x00007FFFA91F0000-0x00007FFFA93E5000-memory.dmp

Filesize
2.0MB

Download
memory/2368-34-0x0000021448860000-0x00000214488C3000-memory.dmp

Filesize
396KB

Download
memory/3036-10-0x00007FFFA91F0000-0x00007FFFA93E5000-memory.dmp

Filesize
2.0MB

Download
memory/3036-13-0x00007FFFA91F0000-0x00007FFFA93E5000-memory.dmp

Filesize
2.0MB

Download
memory/3036-9-0x00007FFFA91F0000-0x00007FFFA93E5000-memory.dmp

Filesize
2.0MB

Download
memory/3036-7-0x00007FFFA91F0000-0x00007FFFA93E5000-memory.dmp

Filesize
2.0MB

Download
memory/3036-6-0x00007FFFA91F0000-0x00007FFFA93E5000-memory.dmp

Filesize
2.0MB

Download
memory/3036-14-0x00007FFFA91F0000-0x00007FFFA93E5000-memory.dmp

Filesize
2.0MB

Download
memory/3036-16-0x00007FFFA91F0000-0x00007FFFA93E5000-memory.dmp

Filesize
2.0MB

Download
memory/3036-17-0x00007FFFA91F0000-0x00007FFFA93E5000-memory.dmp

Filesize
2.0MB

Download
memory/3036-18-0x00007FFF66910000-0x00007FFF66920000-memory.dmp

Filesize
64KB

Download
memory/3036-15-0x00007FFFA91F0000-0x00007FFFA93E5000-memory.dmp

Filesize
2.0MB

Download
memory/3036-19-0x00007FFF66910000-0x00007FFF66920000-memory.dmp

Filesize
64KB

Download
memory/3036-0-0x00007FFF69270000-0x00007FFF69280000-memory.dmp

Filesize
64KB

Download
memory/3036-12-0x00007FFFA91F0000-0x00007FFFA93E5000-memory.dmp

Filesize
2.0MB

Download
memory/3036-11-0x00007FFFA91F0000-0x00007FFFA93E5000-memory.dmp

Filesize
2.0MB

Download
memory/3036-8-0x00007FFFA91F0000-0x00007FFFA93E5000-memory.dmp

Filesize
2.0MB

Download
memory/3036-1-0x00007FFFA928D000-0x00007FFFA928E000-memory.dmp

Filesize
4KB

Download
memory/3036-5-0x00007FFF69270000-0x00007FFF69280000-memory.dmp

Filesize
64KB

Download
memory/3036-4-0x00007FFF69270000-0x00007FFF69280000-memory.dmp

Filesize
64KB

Download
memory/3036-36-0x00007FFFA91F0000-0x00007FFFA93E5000-memory.dmp

Filesize
2.0MB

Download
memory/3036-37-0x00007FFFA928D000-0x00007FFFA928E000-memory.dmp

Filesize
4KB

Download
memory/3036-38-0x00007FFFA91F0000-0x00007FFFA93E5000-memory.dmp

Filesize
2.0MB

Download
memory/3036-2-0x00007FFF69270000-0x00007FFF69280000-memory.dmp

Filesize
64KB

Download
memory/3036-3-0x00007FFF69270000-0x00007FFF69280000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads