Advisory Type
|
Malware Intelligence |
Malware Name
|
IcedID |
Malware Aliases
|
BokBot |
Malware Type
|
Banking Trojan |
Target OS
|
Windows |
Executive Summary
First noticed in 2017, IcedID is a banking trojan that steals financial information. IcedID has also been leveraged as a dropper for other malware and in the infection stage of ransomware operations.
This malware follows multiple delivery methods, out of which phishing emails with macro embedded attachments are the most prevalent. In a recent campaign involving IcedID, attackers abused website contact forms of multiple enterprises, used emails laced with malicious links, which when clicked downloaded a malicious .zip file. These emails, usually, tend to create a sense of urgency, provoking immediate action.
For instance, the sender pretends to be a photographer threatening legal action against the company for using his photos on their site, without permission. The sender then shares a malicious link which purports to be evidence that proves the incident. On clicking the link, however, the recipient is navigated to a Google page that downloads the malicious .zip file.
Technical Analysis
The phishing emails that IcedID campaigns use contain a malicious link, that when clicked on loads a Google page. This page then requires the unsuspecting victim to sign in with their google credentials. Upon signing in a malicious zip file is automatically downloaded on the victim’s machine. If at all the first link fails, they are redirected to a .top domain which then leads to a Google User Content page that downloads the malicious zip file.
Stages of execution:
- The zip file contains a malicious JavaScript that is executed via WScript
- A Shell object is created after executing the previous JS file
- The Shell object launches PowerShell to download the IcedID payload in .dat format
- The IcedID payload is well encrypted to escape detection
Impact
Technical Impact
- IcedID is a banking trojan that steals the victim’s banking credentials and other financial information in the infected system and sends the information gathered to the attacker’s C2.
- IcedID also acts as a loader for other types of payloads like ransomware, furthering other forms of attacks.
Business Impact
- The banking trojan affects the privacy of its victims and abuses their financial information.
- Infecting the system with ransomware will have an adverse impact on the business and its reputation.
Mitigation
- Raise awareness about phishing emails and malicious links.
- Use Multi-Factor Authentication for all accounts.
- Users are advised to patch their systems and always be up to date.
- Use the latest AV software.
Tactics, Techniques, and Procedures
Tactics
|
Techniques
|
Reconnaissance
|
T1594 |
Search victim-owned websites |
Initial Access
|
T1566.001 |
Spear phishing attachment |
T1566.002 |
Spear phishing link |
T1078.002 |
Domain accounts |
Execution
|
T1059 |
Command and scripting interpreter |
T1059.001 |
PowerShell |
T1053.005 |
Scheduled Task |
T1204.001 |
Malicious link |
T1047 |
Windows management Instrumentation |
Persistence
|
T1053.005 |
Scheduled Task |
Privilege Escalation
|
T1055 |
Process injection |
T1053.005 |
Scheduled Task |
Defense Evasion
|
T1055 |
Process injection |
T1218.011 |
Rundll32 |
T1553.002 |
Code signing |
Credential Access
|
T1555.003 |
Credentials from web browsers |
Discovery
|
T1482 |
Domain trust discovery |
T1018 |
Remote system discovery |
T1518.001 |
Security software discovery |
T1082 |
System information discovery |
T1016 |
System network configuration discovery |
Lateral Movement
|
T1021.001 |
Remote Desktop Protocol |
T1021.002 |
SMB/Windows admin shares |
Collection
|
T1185 |
Man in the browser |
Command and Control
|
T1071 |
Application Layer Protocol |
Exfiltration
|
T1048.002 |
Exfiltration over asymmetric encrypted non-C2 protocol |
Impact
|
T1486 |
Data encrypted for impact |
Indicators of Compromise
URL
|
https://tajushariya.com/ds/3003.gif |
https://partsapp.com.br/ds/3003.gif |
https://metaflip.io/ds/3003.gif |
https://columbia.aula-web.net/ds/3003.gif |
https://agenbolatermurah.com/ds/3003.gif |
Hostname
|
columbia.aula-web.net |
Domain
|
agenbolatermurah.com |
metaflip.io |
partsapp.com.br |
tajushariya.com |
File Hash – SHA1
|
191eda0c539d284b29efe556abb05cd75a9077a0 |
e2d681cb701cc399f2df1df7ac393440069c0916 |
816fd4a3c19d91727c835254c083e7a4e946ad54 |
dd58c4d4d12797ccc50488bb511288e50d405e66 |
7a0ff1d3469babd88dcab8db4c1f802a4228d4ab |
922afdba3c7d52a99a7fba0d249297720b4dc811 |
30b666cf091d4fd4bc9ce76a0b11daf07f271d5f |
b7029ba38004200f1b21a4d12337710a67dbea80 |
94f7de7ced668fbe9776cfef701b84e375b1c293 |
fc8b23d3d05c5cc5cab78bae3a84ec8dd9c0eeed |
492c512e14cf59a5dfa8d8e5adfd93858e95100d |
8617364d8958be0bd0e9cdae7320f5c9aae65208 |