{"id":85242,"date":"2017-11-29T18:53:03","date_gmt":"2017-11-29T13:23:03","guid":{"rendered":"https:\/\/blogs_admin.quickheal.com\/?p=85242"},"modified":"2017-11-30T21:13:07","modified_gmt":"2017-11-30T15:43:07","slug":"technical-analysis-icedid-new-sophisticated-banking-trojan-analysis-quick-heal-security-labs","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/technical-analysis-icedid-new-sophisticated-banking-trojan-analysis-quick-heal-security-labs\/","title":{"rendered":"IcedID – a new sophisticated banking Trojan: a technical analysis by Quick Heal Security Labs"},"content":{"rendered":"

IcedID is a new player in the banking Trojan family. It has a modular architecture and capable of stealing banking credentials of the user by performing a man-in-the-middle attack (MITM). IcedID sets up a local proxy and redirects all Internet traffic through it. Additionally, it can download and execute components required for stealth.<\/p>\n

Infection vector<\/strong><\/p>\n

Normally, IcedID spreads through spam email or dropped by other malware families. In our analysis, we found the family to be Emotet. In early 2017, Emotet was widely used to spread other banking Trojans such as Qkabot and Dridex.<\/p>\n

IcedID contains a network spreading module which is rarely observed in other banking Trojans. Looking at the API sequence in IcedID, it has adopted similar techniques which were successfully used by malware such as BadRabit, Petya\/Not-Petya.<\/p>\n

Analysis of sample <\/strong><\/p>\n

On execution, the sample drops a copy of itself on to the folder %LOCAL_APPDATA% <\/strong>with a random name in a randomly named folder. The name of the dropped file and folder is the same and contains 9 characters. The name of the dropped file is generated using a security identifier (SID) of the current user. Below is the code that generates the SID for the current logged on user.<\/p>\n

\"Fig
Fig 1. Generating SID<\/figcaption><\/figure>\n

The name of the dropped file with a random name in a randomly named folder.<\/p>\n

\u201c%LOCALAPPDATA%\\[a-z]{9}\\[a-z]{9}.exe\u201d<\/p>\n

Example: –<\/p>\n

\u201cC:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\homatluna<\/strong>\\homatluna.exe<\/strong>\u201d<\/p>\n

It maintains its persistence by creating a registry entry in \u201cRun\u201d.<\/p>\n

\u201cHKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\homatluna<\/strong>\u201d<\/p>\n

Next IcedID writes a RSA crypto-key to the system into the AppData folder. It then writes a certificate file in %TEMP% folder.<\/p>\n

Example – \u201cC:\\Documents and Settings\\Administrator\\Local Settings\\Temp\\0137194B.tmp<\/strong>\u201d<\/p>\n

Network activity<\/strong><\/p>\n

It creates two socket connections. One for local proxy and another to serve as a backdoor for CnC communication. In our analysis, the port with the local proxy bind is 49158<\/strong> and the backdoor is created on port number 49161<\/strong>.<\/p>\n

It creates a local proxy. Using certificates of different banks and custom module, it implements its own SSL layer. Using this it performs MITM. IcedID can intercept all traffic and extract user credentials from it.<\/p>\n

Once the malware enters the system, it sends the bot ID and basic system information to the CnC server through the POST request as seen in Fig 1 and Fig 2.<\/p>\n

\"Fig
Fig 2. Code to get basic system information<\/figcaption><\/figure>\n
\"Fig
Fig 3. Post basic system info<\/figcaption><\/figure>\n

Following is the decoded post request details to be sent:<\/p>\n

K – System Name<\/em><\/p>\n

B – BOT ID<\/em><\/p>\n

L – Work Group<\/em><\/p>\n

M – OS Version<\/em><\/p>\n

IcedID\u2019s communication with CnC takes place over an encrypted SSL whose certificate is decided by the malware itself from the certificate store. The temp file which is dropped by the malware is used to store the certificate. The below code is used for certificate enumeration.<\/p>\n

\"Fig
Fig 4. Code to enumerate certificate<\/figcaption><\/figure>\n
\"Fig
Fig 5. Certificate stored in the tmp file<\/figcaption><\/figure>\n

Spreading in the network<\/strong><\/p>\n

IcedID is different from other banking Trojans because it can spread within the network. It first finds the live system on the local network and copies itself on to the new system.<\/p>\n

\"Fig
Fig 6. Connects to other machines<\/figcaption><\/figure>\n
\"Fig
Fig 7. Drop a copy on the other system on the network<\/figcaption><\/figure>\n

Indicator of compromises<\/strong><\/p>\n

csuwbru[.]net
\ncomeontrk[.]com
\nmedicalciferol[.]com
\n38921f28bb74fea2cab6e70039ee65f3
\nd982c6de627441765c89da5cfeb04d6f
\n82d6e69df2277073d4aaacd6994ee033<\/p>\n

Quick Heal<\/strong><\/a> successfully detects IcedID as Trojan.IcedID.<\/strong><\/p>\n

The malware\u2019s spreading behavior makes it more aggressive than the previously seen banking Trojans.<\/p>\n

Prevention tips<\/strong><\/p>\n

    \n
  1. Install an antivirus and keep it updated.<\/li>\n
  2. Keep your Operating System and software up-to-date.<\/li>\n
  3. Do not click on links or download attachments from unknown, unexpected or unwanted sources.<\/li>\n<\/ol>\n

     <\/p>\n

    Subject Matter Expert<\/strong>
    \nPiyush Bansal | Ghanshyam More, Quick Heal Security Labs<\/p>\n","protected":false},"excerpt":{"rendered":"

    IcedID is a new player in the banking Trojan family. It has a modular architecture and capable of stealing banking credentials of the user by performing a man-in-the-middle attack (MITM). IcedID sets up a local proxy and redirects all Internet traffic through it. Additionally, it can download and execute components required for stealth. Infection vector […]<\/p>\n","protected":false},"author":12,"featured_media":85252,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[24,5],"tags":[1139,1540,49,1539],"class_list":["post-85242","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-malware","category-security","tag-banking-trojan","tag-icedid","tag-malware","tag-mitm"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/85242"}],"collection":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/comments?post=85242"}],"version-history":[{"count":5,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/85242\/revisions"}],"predecessor-version":[{"id":85255,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/85242\/revisions\/85255"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media\/85252"}],"wp:attachment":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media?parent=85242"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/categories?post=85242"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/tags?post=85242"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}