Analysis of New Wave of Iced ID malware

Iced ID is a banking trojan malware which allows attackers to utilize it to steal banking credentials of the targeted victims. Iced ID aka BokBot mainly targets businesses and steals payment information, it also acts as a loader and can deliver another malware or download additional modules.

Also, Iced ID is capable of propagating throughout the network, allowing it to monitor all activity on the infected system, exfiltrate data, and conduct a man-in-the-browser (MiTB) attack. In specific, the man-in-the-browser attack is made up of three steps: Web-injection, Proxy Setup and Redirection of traffic.

Target Platform – Windows Users

Infection Chain

The new Iced ID campaign infects its victim machine by initial infection vector of malspam campaign. This kind of email contains Microsoft Office word documents (DOC and DOCX). While opening the .doc/.docx file, which contains a button to Enable Macro content. Once the macro contents are enabled by an user, it will start drop the randomized .DLL file in the %Program Data% folder & then perform its action on objectives, the collected data is transferred to its C2 (Command & Control) server.

The initial vector for attacking users may vary depending on the threat actor’s motivation and targeted geography, we all know that the threat actors perform basic reconnaissance against targets prior to deciding their infection vector of choice.

Sample Information

Iced ID Anti Analysis/Debugging

Iced ID is known to use anti-debugging techniques just so security researchers and analysts can’t find and study it. Anti-debugging is a set of methods that malware authors use to discover when their code is being analysed or debugged and change how it works to avoid being found.

Iced ID frequently uses the following methods to stop or evade debugging,

• Checking for debuggers or APIs related to debugging: Iced ID can look for known debuggers like OllyDbg or WinDbg, or it can look for specific APIs related to debugging, like IsDebuggerPresent or NtQueryInformationProcess. If and when a debugger is found, Iced ID may change how it works or stop running to avoid being analyzed.
• Detecting the presence of breakpoints – Iced ID may be able to detect the presence of breakpoints, which are often used by security researchers to stop the execution of a program and look at the system’s memory or register values. If a breakpoint is found, Iced ID may stop working, or change how it works to avoid being analyzed.
• Polymorphic Behaviour – Using code that is capable of changing itself while it’s executed; Iced ID may use code that shape shifts while it’s running to avoid being analyzed. Self-modifying code can be challenging to understand, because it changes all the time and might not be in memory for long periods of time.

These anti-debugging techniques will make life harder for security researchers and analysts to reverse-engineer Iced ID and figure out how it works. They also make it harder for security software to find Iced ID. But with the right tools and methods, like the ones available through LMNTRIX, such as memory forensics or dynamic analysis (LMNTRIX XDR) in a sandboxed environment, these kinds of malicious programs can be analyzed easily.

Technical Analysis of DOC

The .DOC is a file format, which may include formatted text, images, graphs, tables, and charts. _DOC files may be renamed to “”._doc”” files by an email program to prevent the file from being blocked by an email service.

Iced ID uses the .docm file format, which is a document created by Microsoft Word, a popular word processor included with Microsoft Office. It contains embedded macros that can be executed within the document. .docm files are used to automate Word Open XML document (.DOCX) tasks by adding advanced macro functionality.

Template of IcedID

The recent Iced ID campaigns are using the same template for a year now, which has a blurred image contains some details.

Inside the template, we can find this document created in previous version of Microsoft Office Word. To view or edit this document, please click “Enable editing” button on the top bar, and then click “Enable content”.

VBA Macro_Content: This sample contains the heavily randomized VBA functions, in-order to escape from traditional antivirus detection. For this, we need to understand the code logic, and flow first, then debug the malicious code.

Content 1

Content 2

Before Enabling the Macro Content

After Enabling the Macro Content

Metadata of Dropped Payload File

Graphical Flow of Iced ID malware

Once the system is infected, it will perform the following actions;

• Once fully infiltrated, IcedID performs several actions, such as creating a registry entry so that it run on each system startup.
• Establishing & setting up a local proxy.
• Collecting information about the compromised host.
• Creating scheduled tasks (privilege escalation and persistence).
• Credential dumping (.exe access).
• Password stealing (from browser history and cookies).
• Targeting web banking links (web injects).
• Registry manipulation (persistence).
• Replicating its copies.
• Process injection to conceal the malicious action.
• Communicating with the C&C server and ends up waiting for a response from the C&C server in-order to execute the commands.

Based on the C2 Servers Identified in the Wild, we found the following list of hashes from our threat intel;