Spoofed Invoice Used to Drop IcedID | FortiGuard Labs 

MITRE Techniques

• [T1566.001] Phishing – Spearphishing Attachment – The e-mail originated from an IP address in Belize and spoofed the sender to appear legitimate. ‘The e-mail originated from an IP address in Belize, at 179[.]60[.]150[.]96. It spoofs the originating e-mail address to appear to have been sent from another fuel provider in Ukraine.’
• [T1204.002] User Execution – Malicious attachment execution – Attaching invoice_15.zip and instructing extraction to begin infection (‘Attached to the e-mail is a file named “invoice_15.zip”. Extracting the Zip file will drop “invoice_15.iso” and begin the first phase of infection.’)
• [T1218] Signed Binary Proxy Execution – Regsvr32 usage – Regsvr32 is used to register “main.dll” with the Windows registry and launch the code contained within. (‘…Regsvr32 is used to register “main.dll” with the Windows registry and launch the code contained within.’)
• [T1082] System Information Discovery – Information gathered via Windows command-line tools – The malware uses tools to obtain local environment data (e.g., local IP via ipconfig, domain trusts via nltest, domain admins via net group). ‘As seen in Figure 7, once running, the malware uses several Windows command-line tools to obtain information about the local environment. These include capturing the local IP address (ipconfig), enumerating domain trusts (nltest), and capturing a list of domain administrators (net group), among others.’
• [T1071.001] Web Protocols – C2 communication – The sample attempts outbound communication to a C2 server with multiple fallback addresses. ‘The sample then tries to communicate outbound to a command and control (C2) server. There are multiple addresses the malware can connect to in the event one of the destinations becomes unavailable.’