2020-11-03 (Tuesday) - TA551 (Shathak) Japanese-template Word docs pushing IcedID

2020-11-03 (TUESDAY) - TA551 (SHATHAK) JAPANESE-LANGUAGE WORD DOCS WITH MACROS FOR ICEDID:

CHAIN OF EVENTS:

- malspam --> password-protected zip attachment --> extracted Word doc --> enable macros --> installer DLL --> IcedID DLL

11 EXAMPLES OF TA551 WORD DOCS WITH MACROS:

- 155b7e7abe252b7b1ae348bdd0445b5461397f29c56c82bb1e7afc87e0fcd305  charge 11.20.doc
- c71d8532b03a99af0ede0f3bb268f3b3f53435ffbc46596b38aae548f1bf9f50  charge_11.20.doc
- 3e09491e2e4267597694d09e65f6208ab63d63e878edfaa0653d8e88f9caa03a  command_11.20.doc
- 5737ebf8fc8bc8a2a4e8e4d1ae05d95207a391a19edcd8fb97d8020ece4a2ada  details.11.20.doc
- 7a8cc0e27461b621e6f748fa5cd03d3cf4c8049b4dffb3acbad8ef8cf6fc041a  dictate 11.20.doc
- e1ab2e8622760545ce5bee78c6bb427ea2ce1ae76d585246444001a02aa1e819  document.11.20.doc
- b829c4e425398ea86f6e4e7603e6d334e0e18fdc5af381c9a77533ecbd77c59c  legal agreement,11.03.2020.doc
- e10717a822ff3aa6a85d3b369a5b6628558bc2e04b314d55211bc8f0aca2cdba  material_11.20.doc
- b6ed0a10e1808012902c1a911cf1e1b6aa4ad1965e535aebcb95643ef231e214  prescribe _11.20.doc
- 95e97fe5407e7df18d8ac0ebaafd94b2f11e8bbb35e05ed5aeb94d9078d617c3  report.11.03.2020.doc
- c7805a2ea7b27433a505c46efdd24625e93da84935c8fed12ce596040590173e  tell.11.03.2020.doc

AT LEAST 6 DOMAINS HOSTING THE INSTALLER DLL:

- fame5810[.]com - 185.195.24[.]153
- flag1571[.]com - 95.181.178[.]141
- garden1219[.]com - 193.201.126[.]59
- profit3486[.]com - 193.187.175[.]31
- recycle9393[.]com - 54.38.59[.]238
- suffer2379[.]com - 185.118.167[.]183

EXAMPLES OF URLS FOR INSTALLER DLL:

- GET /update/VCGSPgrZnC/FdxMZPIplNBZlcEISXAgzMWGzCOQiJtBRX/gzlov1
- GET /update/sOsKqYBTzNrvmaPkqOFoHTIYMNhyRGqg/aQVIySEmxzG/gzlov2
- GET /update/VvZWoYOIotoWV_KUywQtEUVUPjvNYMYYnLnvWWOLA/fZcXYRwGyzMRZcvzHZrDe/gzlov4
- GET /update/woN/rQbOvqvihHIXKLBlYCNqBgAHSe/w_XL/gzlov5
- GET /update/mJEMKClFIzwEKPDusNHKHOOAnXzPOFPCPfn/YpDIDi_ROm/gzlov6
- GET /update/wrgiVAdbRUYvtSYFHRYIhNHBfkJkYpCNZsG_DUmSN/kiIr/gzlov8
- GET /update/VopJhitKqZWNItBZtQvPqMlnpQbnrxZdthxeYrsMYQOm/FzOCmzMXKRVKYDO/gzlov8
- GET /update/IGOezCcZBkVvvqQlJecdAWYaXkjFbtBb/hNDqngLNGNrbRTArRwYnbqihQsVAEEFnmNif/gzlov9
- GET /update/Jr/cLNVxK/YU/idFFohHNBzrphXDNSYyvPEkSCzb/gzlov11
- GET /update/KdvoVcxOBQKSDpZZxjTihcpVThGEJiKHHNdAVigZUiwpFhO_OnmTFzPvdvRUODZZSyNDtwBddOWqb/gzlov12

6 EXAMPLES OF INSTALLER DLLS:

- 1214f7ff35d8926ae33ea1ea5a596b518b28081ed34d131168b6c53109dc6837
- 3a43d3e6fdf25b7bb004dbedb91ad2bee13a23b7e9b7962a49ba804672196c66
- ad0fbe340bf6448e7f8d4179a2eb5774e0f4a1757262b659214903cdf2f6dfb8
- c128c3d76e488c0b77510a81cfc0d16f9c39dfeba398323338b9d33ab3b11ef8
- c6472bae69e266ae072de28f0ce49161edc6bf041fbfcc59dd7ee4a18a51a283
- da13e8ebda5a45d595aa7dcecb21f9ed8a9202316b081c6e4547febe17b77977

LOCATION FOR THE INSTALLER DLL FILES:

- C:\Users\[username]\AppData\Local\Temp\temp.tmp

DLL RUN METHOD:

- regsvr32.exe [filename]

HTTPS TRAFFIC TO LEGITIMATE DOMAINS CAUSED BY INSTALLER DLL:

- port 443 - help.twitter.com
- port 443 - www.intel.com
- port 443 - www.oracle.com
- port 443 - support.oracle.com
- port 443 - support.apple.com
- port 443 - support.microsoft.com

URL FOR HTTPS TRAFFIC GENERATED BY INSTALLER DLLS:

- 167.99.248[.]130 port 443 - voairtaxetion[.]xyz - GET /background.png

2 EXAMPLES OF SHA256 HASHES FOR ICEDID DLL CREATED BY INSTALLER:

- c3c78f071dd03d76bd6d6b353e8eca54068971653519e8106fb171db8923f871 (initial)
- 4c782e4a2b49fdb166aa6a906a502b319388e45e8e4a9f3a523eacb0ce1834cd (persistent)

HTTPS TRAFFIC TO MALICIOUS DOMAINS CAUSED BY THE ICEDID DLL FILES:

-  104.248.90[.]150 port 443 - blokaddio[.]top
-  104.248.90[.]150 port 443 - defeodallio[.]cyou
-  104.248.90[.]150 port 443 - grekilioliplane[.]best
-  104.248.90[.]150 port 443 - nawserty8[.]club
-  104.248.90[.]150 port 443 - quaddroporrte4[.]top