splunk-security_content/docs/_stories/icedid.md

title, last_modified_at, toc, tags

title	last_modified_at	toc	tags
IcedID	2021-07-29	true	Splunk Enterprise Splunk Enterprise Security Splunk Cloud Endpoint

Try in Splunk Security Cloud{: .btn .btn--success}

Description

Leverage searches that allow you to detect and investigate unusual activities that might relate to the IcedID banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection.

• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Endpoint
• Last Updated: 2021-07-29
• Author: Teoderick Contreras, Splunk
• ID: 1d2cc747-63d7-49a9-abb8-93aa36305603

Narrative

IcedId banking trojan campaigns targeting banks and other vertical sectors.This malware is known in Microsoft Windows OS targetting browser such as firefox and chrom to steal banking information. It is also known to its unique payload downloaded in C2 where it can be a .png file that hides the core shellcode bot using steganography technique or gzip dat file that contains "license.dat" which is the actual core icedid bot.

Detections

Name	Technique	Type
Account Discovery With Net App	Domain Account, Disable or Modify Tools, Command and Scripting Interpreter, Process Injection, Malicious File, Bypass User Account Control, Modify Registry, Archive via Utility, Mshta, Domain Trust Discovery, Spearphishing Attachment, Registry Run Keys / Startup Folder, Rundll32, Scheduled Task/Job, Data from Local System, Regsvr32, IP Addresses, Obfuscated Files or Information, Scheduled Task, SMB/Windows Admin Shares	TTP
CHCP Command Execution	Command and Scripting Interpreter	TTP
Create Remote Thread In Shell Application	Process Injection	TTP
Drop IcedID License dat	Malicious File	Hunting
Eventvwr UAC Bypass	Bypass User Account Control	TTP
FodHelper UAC Bypass	Modify Registry, Bypass User Account Control	TTP
IcedID Exfiltrated Archived File Creation	Archive via Utility	Hunting
Mshta spawning Rundll32 OR Regsvr32 Process	Mshta	TTP
NLTest Domain Trust Discovery	Domain Trust Discovery	TTP
Office Application Spawn Regsvr32 process	Spearphishing Attachment	TTP
Office Application Spawn rundll32 process	Spearphishing Attachment	TTP
Office Document Executing Macro Code	Spearphishing Attachment	TTP
Office Product Spawning MSHTA	Spearphishing Attachment	TTP
Registry Keys Used For Persistence	Registry Run Keys / Startup Folder	TTP
Rundll32 Create Remote Thread To A Process	Process Injection	TTP
Rundll32 CreateRemoteThread In Browser	Process Injection	TTP
Rundll32 DNSQuery	Rundll32	TTP
Rundll32 Process Creating Exe Dll Files	Rundll32	TTP
Schedule Task with Rundll32 Command Trigger	Scheduled Task/Job	TTP
Sqlite Module In Temp Folder	Data from Local System	TTP
Suspicious IcedID Regsvr32 Cmdline	Regsvr32	TTP
Suspicious IcedID Rundll32 Cmdline	Rundll32	TTP
Suspicious Rundll32 PluginInit	Rundll32	TTP
WinEvent Scheduled Task Created Within Public Path	Scheduled Task	TTP

Reference

• https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/
• https://app.any.run/tasks/48414a33-3d66-4a46-afe5-c2003bb55ccf/

source | version: 1