icedid | 21f835ee382f4e48669282b0a3acbe667ebf0146ff45daaccdd51ae713b9ae63

General

Target

415abfb2785209977e7293d58e6ec29345a1be9dc343ae69f17e96c5346f9fe7.xll
Size

70KB
MD5

dc79488b73f6e411302d08abf1f9bddc
SHA1

3dfcc55455437077a3b91347cdd7dd30fd047244
SHA256

415abfb2785209977e7293d58e6ec29345a1be9dc343ae69f17e96c5346f9fe7
SHA512

34dab5c2e7137e035b7e6ff031959e4ce2c29a0f7be3384ca9af9a87b0f0c1d69abeab7a612d46c2b7da837dc9cf22a04b6209656602e9d0274dd8c59b3a683e
SSDEEP

1536:TXUu70LgnxCl7f/3jWCgiMthg8Mi3lHg9gIgmfgCjMiAOqTu/+vXWPbge96LI4hH:TwL6C5fPKCNAXMixmHBfFzmu/mAbgwuh

Score

10^/10

icedid 497724135 banker loader trojan

Malware Config

Extracted

Language

xlm4.0

Source

Extracted

Family

icedid

Campaign

497724135

C2

ovedfromasi.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4184	4792	rundll32.exe	81

Blocklisted process makes network request 1 IoCs

flow	pid	Process
24	4184	rundll32.exe

Loads dropped DLL 3 IoCs

pid	Process
4792	EXCEL.EXE
4792	EXCEL.EXE
4184	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4792	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4184	rundll32.exe
4184	rundll32.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4792	EXCEL.EXE
4792	EXCEL.EXE
4792	EXCEL.EXE
4792	EXCEL.EXE
4792	EXCEL.EXE
4792	EXCEL.EXE
4792	EXCEL.EXE
4792	EXCEL.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 4184	4792	EXCEL.EXE	85
PID 4792 wrote to memory of 4184	4792	EXCEL.EXE	85

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\415abfb2785209977e7293d58e6ec29345a1be9dc343ae69f17e96c5346f9fe7.xll"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\SYSTEM32\rundll32.exe
  rundll32 C:\Users\Admin\JetBrainsdotJ.dll , DllGetClassObject
  2⤵
  - Process spawned unexpected child process
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\415abfb2785209977e7293d58e6ec29345a1be9dc343ae69f17e96c5346f9fe7.xll

Filesize
70KB

MD5
dc79488b73f6e411302d08abf1f9bddc

SHA1
3dfcc55455437077a3b91347cdd7dd30fd047244

SHA256
415abfb2785209977e7293d58e6ec29345a1be9dc343ae69f17e96c5346f9fe7

SHA512
34dab5c2e7137e035b7e6ff031959e4ce2c29a0f7be3384ca9af9a87b0f0c1d69abeab7a612d46c2b7da837dc9cf22a04b6209656602e9d0274dd8c59b3a683e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
1143fd458ee35cd23ce054d196469ec8

SHA1
f1e169247143c2d1111c5b2e150e622868d95010

SHA256
d905a9e6119666c5748b7406fac42b13a97ce7c723f708275dde15029051e22c

SHA512
b82a19f0d704c50c0bf56a91d053f529eab7f59139b83ef3b1c61bddc0fdaef16a552cc51ed6e9cc563cc0e5fc3ba4ea8c9c9bff5d9a1ee37ca4437848194807

Download Submit
C:\Users\Admin\JetBrainsdotJ.dll

Filesize
38KB

MD5
e0eb5ee1877137874ffa2da89ea711a4

SHA1
7be7d4eab05c0070ece0ca1e54b183829b227588

SHA256
33656b2710aa5d69afa7402f050b8f812923743f86a5bf4d1f22f8ce29be7179

SHA512
ca47e2a86edecffa9c6250d98750f7a49530dbea2bcff74678ab43d38410b2b3fdf8ea5b69bc656472ab3915fd225ff5ade64b3699d182075ed94155a56ec215

Download Submit
memory/4184-47-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

Filesize
2.0MB

Download
memory/4184-35-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

Filesize
2.0MB

Download
memory/4184-34-0x000001ABC3DF0000-0x000001ABC3E53000-memory.dmp

Filesize
396KB

Download
memory/4792-9-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

Filesize
2.0MB

Download
memory/4792-15-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

Filesize
2.0MB

Download
memory/4792-11-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

Filesize
2.0MB

Download
memory/4792-12-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

Filesize
2.0MB

Download
memory/4792-10-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

Filesize
2.0MB

Download
memory/4792-13-0x00007FF807F30000-0x00007FF807F40000-memory.dmp

Filesize
64KB

Download
memory/4792-14-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

Filesize
2.0MB

Download
memory/4792-17-0x00007FF807F30000-0x00007FF807F40000-memory.dmp

Filesize
64KB

Download
memory/4792-16-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

Filesize
2.0MB

Download
memory/4792-18-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

Filesize
2.0MB

Download
memory/4792-19-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

Filesize
2.0MB

Download
memory/4792-1-0x00007FF809F90000-0x00007FF809FA0000-memory.dmp

Filesize
64KB

Download
memory/4792-8-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

Filesize
2.0MB

Download
memory/4792-7-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

Filesize
2.0MB

Download
memory/4792-6-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

Filesize
2.0MB

Download
memory/4792-5-0x00007FF809F90000-0x00007FF809FA0000-memory.dmp

Filesize
64KB

Download
memory/4792-4-0x00007FF809F90000-0x00007FF809FA0000-memory.dmp

Filesize
64KB

Download
memory/4792-3-0x00007FF809F90000-0x00007FF809FA0000-memory.dmp

Filesize
64KB

Download
memory/4792-36-0x00007FF849FAD000-0x00007FF849FAE000-memory.dmp

Filesize
4KB

Download
memory/4792-37-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

Filesize
2.0MB

Download
memory/4792-38-0x00007FF849F10000-0x00007FF84A105000-memory.dmp

Filesize
2.0MB

Download
memory/4792-2-0x00007FF809F90000-0x00007FF809FA0000-memory.dmp

Filesize
64KB

Download
memory/4792-0-0x00007FF849FAD000-0x00007FF849FAE000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads