icedid | 77f3784b57f565a77044d5ae2cf7d1a1b5d23310f11a11b10092ad6cd573ae20

General

Target

d1e61f9b080e3b6892df3660c346870ec62ce7627437bc666d7e369e215f5f43.xll
Size

70KB
MD5

9fc21e4ab45c411b8251d493963608f3
SHA1

e0f7283f01221c9f54a2aff23bd426340bd00550
SHA256

d1e61f9b080e3b6892df3660c346870ec62ce7627437bc666d7e369e215f5f43
SHA512

03a6f8d64f2bbc0048d4bc00f3bc28b72ff1109cbf0cd5ed401ca6a893225f4b5fc51a7dd495ffb43f2aac2b378e77685b346c523219ca3173cc396913a60793
SSDEEP

1536:IXUu709gnZwl7f/3jWCgiMthg8Mi3lHg9gIgmfgCjMiAOqTu/+vXWPbge96LJ4hH:Iw9ew5fPKCNAXMixmHBfFzmu/mAbgwhh

Score

10^/10

icedid 497724135 banker loader trojan

Malware Config

Extracted

Language

xlm4.0

Source

Extracted

Family

icedid

Campaign

497724135

C2

ovedfromasi.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Icedid family
icedid

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3948	1796	rundll32.exe	82

Blocklisted process makes network request 1 IoCs

flow	pid	Process
21	3948	rundll32.exe

Loads dropped DLL 3 IoCs

pid	Process
1796	EXCEL.EXE
1796	EXCEL.EXE
3948	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1796	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3948	rundll32.exe
3948	rundll32.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1796	EXCEL.EXE
1796	EXCEL.EXE
1796	EXCEL.EXE
1796	EXCEL.EXE
1796	EXCEL.EXE
1796	EXCEL.EXE
1796	EXCEL.EXE
1796	EXCEL.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 3948	1796	EXCEL.EXE	85
PID 1796 wrote to memory of 3948	1796	EXCEL.EXE	85

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d1e61f9b080e3b6892df3660c346870ec62ce7627437bc666d7e369e215f5f43.xll"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SYSTEM32\rundll32.exe
  rundll32 C:\Users\Admin\JetBrainsdotNef.dll , DllGetClassObject
  2⤵
  - Process spawned unexpected child process
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d1e61f9b080e3b6892df3660c346870ec62ce7627437bc666d7e369e215f5f43.xll

Filesize
70KB

MD5
9fc21e4ab45c411b8251d493963608f3

SHA1
e0f7283f01221c9f54a2aff23bd426340bd00550

SHA256
d1e61f9b080e3b6892df3660c346870ec62ce7627437bc666d7e369e215f5f43

SHA512
03a6f8d64f2bbc0048d4bc00f3bc28b72ff1109cbf0cd5ed401ca6a893225f4b5fc51a7dd495ffb43f2aac2b378e77685b346c523219ca3173cc396913a60793

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
2KB

MD5
b0a049b75259036600de21f4989cf102

SHA1
e0579eebf8ea442f7c61af7946dcad4273acc0cb

SHA256
f36e1b811f4beb6589f380529c60b699b5e7e928b6801603cc7fd9816a42eaf0

SHA512
97db8f1118d27e4c067102ab2aa49ac4c3c7d91e35262aa5af5ab569cca14f2651f3d0899bddf1ea724f1e945a4e5ce346aeac3797cad3ccf73ac73a21546a91

Download Submit
C:\Users\Admin\JetBrainsdotNef.dll

Filesize
38KB

MD5
e0eb5ee1877137874ffa2da89ea711a4

SHA1
7be7d4eab05c0070ece0ca1e54b183829b227588

SHA256
33656b2710aa5d69afa7402f050b8f812923743f86a5bf4d1f22f8ce29be7179

SHA512
ca47e2a86edecffa9c6250d98750f7a49530dbea2bcff74678ab43d38410b2b3fdf8ea5b69bc656472ab3915fd225ff5ade64b3699d182075ed94155a56ec215

Download Submit
memory/1796-17-0x00007FFD83610000-0x00007FFD83805000-memory.dmp

Filesize
2.0MB

Download
memory/1796-5-0x00007FFD43690000-0x00007FFD436A0000-memory.dmp

Filesize
64KB

Download
memory/1796-10-0x00007FFD83610000-0x00007FFD83805000-memory.dmp

Filesize
2.0MB

Download
memory/1796-11-0x00007FFD83610000-0x00007FFD83805000-memory.dmp

Filesize
2.0MB

Download
memory/1796-8-0x00007FFD83610000-0x00007FFD83805000-memory.dmp

Filesize
2.0MB

Download
memory/1796-12-0x00007FFD41290000-0x00007FFD412A0000-memory.dmp

Filesize
64KB

Download
memory/1796-7-0x00007FFD83610000-0x00007FFD83805000-memory.dmp

Filesize
2.0MB

Download
memory/1796-6-0x00007FFD83610000-0x00007FFD83805000-memory.dmp

Filesize
2.0MB

Download
memory/1796-14-0x00007FFD41290000-0x00007FFD412A0000-memory.dmp

Filesize
64KB

Download
memory/1796-13-0x00007FFD83610000-0x00007FFD83805000-memory.dmp

Filesize
2.0MB

Download
memory/1796-15-0x00007FFD83610000-0x00007FFD83805000-memory.dmp

Filesize
2.0MB

Download
memory/1796-1-0x00007FFD836AD000-0x00007FFD836AE000-memory.dmp

Filesize
4KB

Download
memory/1796-16-0x00007FFD83610000-0x00007FFD83805000-memory.dmp

Filesize
2.0MB

Download
memory/1796-9-0x00007FFD83610000-0x00007FFD83805000-memory.dmp

Filesize
2.0MB

Download
memory/1796-4-0x00007FFD43690000-0x00007FFD436A0000-memory.dmp

Filesize
64KB

Download
memory/1796-3-0x00007FFD43690000-0x00007FFD436A0000-memory.dmp

Filesize
64KB

Download
memory/1796-2-0x00007FFD43690000-0x00007FFD436A0000-memory.dmp

Filesize
64KB

Download
memory/1796-42-0x00007FFD83610000-0x00007FFD83805000-memory.dmp

Filesize
2.0MB

Download
memory/1796-0-0x00007FFD43690000-0x00007FFD436A0000-memory.dmp

Filesize
64KB

Download
memory/1796-34-0x00007FFD83610000-0x00007FFD83805000-memory.dmp

Filesize
2.0MB

Download
memory/1796-35-0x00007FFD836AD000-0x00007FFD836AE000-memory.dmp

Filesize
4KB

Download
memory/1796-36-0x00007FFD83610000-0x00007FFD83805000-memory.dmp

Filesize
2.0MB

Download
memory/3948-33-0x00007FFD83610000-0x00007FFD83805000-memory.dmp

Filesize
2.0MB

Download
memory/3948-32-0x0000018384C40000-0x0000018384CA3000-memory.dmp

Filesize
396KB

Download
memory/3948-46-0x00007FFD83610000-0x00007FFD83805000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads