Procedure examples

IcedID used the `ipconfig /all` command and a batch script to gather network information.

IcedID has packed and encrypted its loader module.

IcedID has embedded binaries within RC4 encrypted .png files.

IcedID has embedded malicious functionality in a legitimate DLL file.

IcedID has utilzed encrypted binaries and base64 encoded strings.

IcedID has modified legitimate .dll files to include malicious code.

IcedID has used WMI to execute binaries.

IcedID has exfiltrated collected data via HTTPS.

IcedID has created a scheduled task to establish persistence.

IcedID has used ZwQueueApcThread to inject itself into remote processes.

IcedID can inject a Cobalt Strike beacon into cmd.exe via process hallowing.

IcedID has used obfuscated VBA string expressions.

IcedID has the ability to identify Workgroup membership.

IcedID has used HTTPS in communications with C2.

IcedID has the ability to identify the computer name and OS version on a compromised host.

IcedID can query LDAP and can use built-in `net` commands to identify additional users on the network to infect.

IcedID has the ability to download additional modules and a configuration file from C2.

IcedID has called ZwWriteVirtualMemory, ZwProtectVirtualMemory, ZwQueueApcThread, and NtResumeThread to inject itself into a remote process.

IcedID has used the `net view /all` command to show available shares.

IcedID has used web injection attacks to redirect victims to spoofed sites designed to harvest banking and other credentials. IcedID can use a self signed TLS certificate in connection with the spoofed site and simultaneously maintains a live connection with the legitimate site to display the correct URL and certificates in the browser.

IcedID has cloned legitimate websites/applications to distribute the malware.

IcedID has been executed through Word and Excel files with malicious embedded macros and through ISO and LNK files that execute the malicious DLL.

IcedID can inject itself into a suspended msiexec.exe process to send beacons to C2 while appearing as a normal msi application. IcedID has also used msiexec.exe to deploy the IcedID loader.

IcedID has used rundll32.exe to execute the IcedID loader.

IcedID used Nltest during initial discovery.

IcedID has manipulated Keitaro Traffic Direction System to filter researcher and sandbox traffic.

IcedID can identify AV products on an infected host using the following command:
` WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get * /Format:List`.

IcedID has established persistence by creating a Registry run key.

IcedID has been delivered via phishing e-mails with malicious attachments.

IcedID has used SSL and TLS in communications with C2.

IcedID used the following command to check the country/language of the active console:
` cmd.exe /c chcp >&2`.