Full Report
When ice burns through bank accounts
Analysis Summary
# Tool/Technique: IcedID (BokBot)
## Overview
IcedID, also known as BokBot, is a sophisticated banking Trojan that has evolved into a versatile downloader and entry point for ransomware operations. Originally designed to steal financial credentials through web injection and redirection, it now features a multi-stage architecture, modular payloads, and advanced evasion techniques to bypass security controls.
## Technical Details
- **Type:** Malware Family (Banking Trojan / Downloader)
- **Platform:** Windows
- **Capabilities:** Credential theft, remote command execution (Reverse Shell), modular plugin delivery, traffic interception, and anti-analysis (VM/Debugger detection).
- **First Seen:** 2017
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.001 - Phishing: Spearphishing Attachment
- **TA0002 - Execution**
- T1059.003 - Command and Scripting Interpreter: Windows Command Shell
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information
- T1497.001 - Virtualization/Sandbox Evasion: System Checks
- **TA0011 - Command and Control**
- T1090.003 - Proxy: Multi-hop Proxy (SOCKS)
- T1071.001 - Application Layer Protocol: Web Protocols (HTTPS)
## Functionality
### Core Capabilities
- **Multi-Stage Loading:** Utilizes a small downloader/loader (Stage 1) to fetch and decrypt the main module (Stage 2) in memory.
- **Persistence:** Establishes persistence via Scheduled Tasks or registry modifications.
- **Traffic Interception:** Hooks network-related functions to perform Man-in-the-Browser (MitB) attacks and inject malicious scripts into banking sessions.
- **Modular Architecture:** Downloads additional modules (e.g., VNC, SOCKS proxy, Backconnect) based on the victim's profile.
### Advanced Features
- **Hidden Reverse Shell:** The SOCKS module contains an unconventional feature where specifying a specific local address (`127.0.0.1:39426`) triggers the execution of `cmd.exe` bound to network pipes, providing a remote shell.
- **Steganography/Obfuscation:** Hides encrypted data within legitimate-looking files on the file system and uses custom encryption for C2 traffic.
- **Anti-Analysis:** Includes checks for virtual environments and debuggers to prevent execution in automated sandboxes.
## Indicators of Compromise
- **File Hashes (MD5):**
- `c897c555d395627dedf7e9e91623f54c` (Loader)
- `f89d448700de774c0b27762f327bd13f` (Loader)
- `6A44BEFDED3DA2245EF3A78E396CE5E0` (Encrypted Main Module)
- **Network Indicators (C2):**
- hXXps://poloturtles[.]top/audio
- hXXps://robertogunez[.]xyz/audio
- hXXps://gotofresno[.]xyz/audio
- hXXps://fordthunderbirth[.]site/audio
- hXXps://luxcarlegend[.]top/audio
- **Behavioral Indicators:**
- Creation of `cmd.exe` as a child process of the IcedID service/module process.
- Unusual synchronization of I/O via named pipes to network sockets.
- HTTPS requests ending in `/audio` or specific resource paths to suspicious TLDs (.top, .xyz, .cloud).
## Associated Threat Actors
- **Lunar Spider** (CrowdStrike attribution)
- Often used as a precursor to **REvil**, **Conti**, or **Maze** ransomware deployments.
## Detection Methods
- **Signature-based detection:** Endpoint security solutions should flag known MD5/SHA256 hashes of the initial loader and the main DLL module.
- **Behavioral detection:** Monitor for unauthorized `cmd.exe` processes initiated by non-interactive services or applications. Watch for unexpected network connections originating from browser processes (hooking).
- **Network Inspection:** Identify C2 patterns involving specific URI paths (e.g., `/audio`) and high-entropy encrypted payloads over HTTPS.
## Mitigation Strategies
- **Email Filtering:** Implement robust attachment scanning to block malicious macros or .iso/.img files used in initial delivery.
- **Process Auditing:** Enable Command Line Logging (Event ID 4688) to track the execution of suspicious shell commands.
- **Network Segmentation:** Limit egress traffic to prevent SOCKS proxy modules from communicating with C2 infrastructure.
## Related Tools/Techniques
- **Emotet / Qakbot:** Often used in similar infection chains.
- **SOCKS5 Proxy:** Used for lateral movement and tunneling within the victim network.
- **TrickBot:** Shares similar modular characteristics and evolved from a banking Trojan to a loader.