IcedID
Techniques Used |
||||
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1087 | .002 | Account Discovery: Domain Account |
IcedID can query LDAP to identify additional users on the network to infect.(Citation: IBM IcedID November 2017) |
| Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols |
IcedID has used HTTPS in communications with C2.(Citation: Juniper IcedID June 2020) |
| Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
IcedID has established persistence by creating a Registry run key.(Citation: IBM IcedID November 2017) |
| Enterprise | T1059 | .005 | Command and Scripting Interpreter: Visual Basic |
IcedID has used obfuscated VBA string expressions.(Citation: Juniper IcedID June 2020) |
| Enterprise | T1573 | .002 | Encrypted Channel: Asymmetric Cryptography |
IcedID has used SSL and TLS in communications with C2.(Citation: IBM IcedID November 2017)(Citation: Juniper IcedID June 2020) |
| Enterprise | T1027 | .002 | Obfuscated Files or Information: Software Packing |
IcedID has packed and encrypted its loader module.(Citation: Juniper IcedID June 2020) |
| .003 | Obfuscated Files or Information: Steganography |
IcedID has embedded binaries within RC4 encrypted .png files.(Citation: Juniper IcedID June 2020) |
||
| Enterprise | T1566 | .001 | Phishing: Spearphishing Attachment |
IcedID has been delivered via phishing e-mails with malicious attachments.(Citation: Juniper IcedID June 2020) |
| Enterprise | T1055 | .004 | Process Injection: Asynchronous Procedure Call |
IcedID has used |
| Enterprise | T1053 | .005 | Scheduled Task/Job: Scheduled Task |
IcedID has created a scheduled task that executes every hour to establish persistence.(Citation: Juniper IcedID June 2020) |
| Enterprise | T1218 | .007 | System Binary Proxy Execution: Msiexec |
IcedID can inject itself into a suspended msiexec.exe process to send beacons to C2 while appearing as a normal msi application. (Citation: Juniper IcedID June 2020) |
| Enterprise | T1204 | .002 | User Execution: Malicious File |
IcedID has been executed through Word documents with malicious embedded macros.(Citation: Juniper IcedID June 2020) |
Groups That Use This Software |
||
| ID | Name | References |
|---|---|---|
| G0127 | TA551 |
(Citation: Cybereason Valak May 2020) (Citation: Unit 42 Valak July 2020) (Citation: Unit 42 TA551 Jan 2021) (Citation: Secureworks GOLD CABIN) |
References
- Kessem, L., et al. (2017, November 13). New Banking Trojan IcedID Discovered by IBM X-Force Research. Retrieved July 14, 2020.
- Kimayong, P. (2020, June 18). COVID-19 and FMLA Campaigns used to install new IcedID banking malware. Retrieved July 14, 2020.
- Salem, E. et al. (2020, May 28). VALAK: MORE THAN MEETS THE EYE . Retrieved June 19, 2020.
- Duncan, B. (2020, July 24). Evolution of Valak, from Its Beginnings to Mass Distribution. Retrieved August 31, 2020.
- Duncan, B. (2021, January 7). TA551: Email Attack Campaign Switches from Valak to IcedID. Retrieved March 17, 2021.
- Secureworks. (n.d.). GOLD CABIN Threat Profile. Retrieved March 17, 2021.
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.