Investigate IcedID malware using VirusTotal and threat intelligence platforms

Introduction: Investigate IcedID malware using VirusTotal and threat intelligence platforms to identify IOCs, associated threat actors, and execution mechanisms.

Scenario: A cyber threat group was identified for initiating widespread phishing campaigns to distribute further malicious payloads. The most frequently encountered payloads were IcedID. You have been given a hash of an IcedID sample to analyze and monitor the activities of this advanced persistent threat (APT) group.

================================================================================================

This lab introduces the IcedID malware. For those who are unfamiliar with IcedID, here is a brief summary:

• IcedID is malware designed to steal financial credentials, targeting bank accounts, cookies, and browser data.

We will collect, investigate, and synthesize information about this malware and analyze the activities that APT groups may leverage it for. We will use VirusTotal as the main platform for gathering related information.

File hash: 191eda0c539d284b29efe556abb05cd75a9077a0

According to VirusTotal statistics, 43 out of 66 security vendors flag this file as malicious, with Trojan being the most common classification.

The first thing we should do is determine what the filename is for this hash value.

When we go to the Details section, we can see that the extension of the file with this hash is .xlsx (.xlsm). This extension is commonly used in Excel today.

The specific name of this malware file is: document-1982481273.xlsm

If we scroll up to the History section, we can see timeline-related information:

• Creation time: roughly the time when the file was built/compiled or created on the attacker system.
• First submission: when it was first uploaded to VirusTotal.
• Last submission: the most recent upload.
• Last analysis: the latest scan by the system.

This shows that this malware has existed since 2006, nearly 20 years ago, and is still being used by attackers today if organizations do not remain vigilant.

In the Relations section, you will see the URLs that this malware contacted. More precisely, it contacted these domains in an attempt to retrieve a file named 3003.gif. We do not yet know what is inside this .gif file, but the image shows that the malware queried 5 domains to locate and download this .gif file for attack purposes.

We can also see which registrar issued these domains to the attacker right below.

According to the information, tajushariya.com was registered by NameCheap Inc. The other domains are not clearly attributed to a provider.

NameCheap is generally a fairly reputable DNS/domain provider with more than 20 years of operation, though it is more of a mid-tier provider than a top-tier one.

So far, we have only been collecting information on VirusTotal. Now let us move to MITRE ATT&CK, a well-known framework for studying the tactics and techniques that malware/attackers use throughout the infection and attack process.

So which threat actor used this malware? Navigate to the “Groups That Use This Software” section in MITRE.

In this lab, I mainly focus on the TA551 group. If you are curious, I encourage you to spend some time exploring the official MITRE website to learn more about other threat actors.

TA551 is a financially motivated threat group active since at least 2018. Its targets are mainly people in the UK, Germany, Italy, and Japan through phishing campaigns distributing malware via email.

One of the most well-known threats associated with TA551 is GOLD CABIN[1]. Below is an image showing the prevalence of GOLD CABIN worldwide as of March 17, 2021, with a concentration mainly in Asia.

(source: SOPHOS)

The techniques used are numerous. To keep this lab presentation from becoming too long, I will focus only on the Execution phase. You can explore further on the official MITRE site.

I used the JoeSandbox platform to investigate the Execution phase. It is a popular sandbox-friendly platform for beginners entering the blue team field.

Go to “Full Report”.

(full interface in JoeSandbox)

Scroll down a bit until you see the MITRE ATT&CK Matrix.

Go to “Exploitation for Client Execution” in the Execution phase.

The signatures here are rules or behaviors detected while running the sample. They are used to:

• Detect malicious behavior.
• Label activity as exploit, suspicious, malware, etc.
• Calculate a risk score.

Look deeper into the “Document exploit detected ‘UrlDownloadToFile’” section. For those who do not know what UrlDownloadToFile is:

• It means that a Word/Excel/PDF file, when executed, calls the UrlDownloadToFile API. This API is used to download files from the Internet to the machine.

Why is this marked as an exploit? Normally, Office files do not download files from the Internet on their own. If they do, it is often an exploit, macro, or second-stage payload. That is why this deserves special attention.

This signature is evidence that the .xlsm file is trying to download a file or payload from the Internet.

The image clearly shows that Excel called the UrlDownloadToFile API, which is a sign of downloading from the Internet.

Source: EXCEL.EXE

• This behavior originates from Excel.
• This means: you open an Excel file, and Excel is being abused (via macro/exploit).

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll

• This is a system DLL related to networking and file handling.
• It is used to download files.

Origin: URLDownloadToFileA

• This is the ANSI version of the download API.
• It confirms that the file is being downloaded from the Internet through HTTP/HTTPS.

The key takeaway here is that Excel is not downloading files from the Internet on its own. Something is controlling it (a macro or exploit).

Through this lab, we have practiced skills in malware analysis and threat intelligence:

• Analyzing malware samples on VirusTotal: identifying file names, hashes, extensions, history, and severity.
• Collecting IOCs: domains, URLs, and associated network behavior.
• Understanding threat actors and campaigns through MITRE ATT&CK.
• Analyzing behavior in a sandbox (Joe Sandbox): reading signatures and understanding execution flow.
• Identifying attack techniques such as T1203 Exploitation for Client Execution.
• Detecting exploit/macro indicators, such as calls to download payloads from the Internet.

[1] GOLD CABIN is a name assigned by vendors, not a name chosen by the attacker group itself. In general, this refers to financially motivated groups that mainly target Germany, Italy, and Japan through email malware campaigns as described above.