Investigate IcedID malware using VirusTotal and threat intelligence platforms to identify IOCs, associated threat actors, and execution mechanisms.
A cyber threat group was identified for initiating widespread phishing campaigns to distribute further malicious payloads. The most frequently encountered payloads were IcedID. You have been given a hash of an IcedID sample to analyze and monitor the activities of this advanced persistent threat (APT) group.
Easy - Threat Intel | Completion Achievement
The provided hash is 191eda0c539d284b29efe556abb05cd75a9077a0.
- What is the name of the file associated with the given hash?
To find the name of the file, we can simply lookup the hash on VirusTotal, navigate to the Details > Names section, and select the most appropiate name.
- Can you identify the filename of the GIF file that was deployed?
We can find all deployed files by navigating to the Relations > Dropped Files pane on the VirusTotal report. The GIF file that appears here is actually a malicious DLL in disguise.
To submit the answer, remove the [1] string from the filename.
- How many domains does the malware look to download the additional payload file in Q2?
We can identify which domains were contacted to download the 3003.gif file by checking the Relations > Contacted URLs and counting how many times the 3003.gif file appears.
- From the domains mentioned in Q3, a DNS registrar was predominantly used by the threat actor to host their harmful content, enabling the malware's functionality. Can you specify the Registrar INC?
We can find our answer by doing some correlation between the Contacted URLs containing the payload and the domain names shown in Contacted Domains. One of the contacted domains is associated with a well-known registrar.
- Could you specify the threat actor linked to the sample provided?
Doing some online research with the given SHA256 hash, we eventually reach the Malpedia page for the IcedID malware, which contains the responsible threat actors:
- In the Execution phase, what function does the malware employ to fetch extra payloads onto the system?
To look deeper into what the malware actually does, we need to find a report showing what happens when the malware is executed. First, I found a report on MalwareBazaar which led me to an Any.run task demonstrating the malware in action. Looking into the process list, we can see process 1496 making calling suspicious WIN API functions. One of these is used to fetch payloads:
