IcedID Malware Strikes Again: Active Directory Domain Compromised in Under 24 Hours

Jan 12, 2023Ravie LakshmananActive Directory / Malware

A recent IcedID malware attack enabled the threat actor to
compromise the Active Directory domain of an unnamed target less
than 24 hours after gaining initial access.

“Throughout the attack, the attacker followed a routine of recon
commands, credential theft, lateral movement by abusing Windows
protocols, and executing Cobalt Strike on the newly compromised
host,” Cybereason researchers said^[1]
in a report published this week.

IcedID^[2], also known by the name
BokBot, started its life as a banking trojan in 2017 before
evolving into a dropper for other malware^[3], joining the likes of
Emotet^[4], TrickBot^[5], Qakbot^[6], Bumblebee^[7], and Raspberry Robin^[8].

Attacks involving the delivery of IcedID have leveraged a variety of methods^[9], especially in the wake
of Microsoft’s decision to block
macros^[10] from Office files
downloaded from the web.

The intrusion detailed by Cybereason is no different in that the
infection chain begins with an ISO image file contained within a
ZIP archive that culminates in the execution of the IcedID
payload.

The malware then establishes persistence on the host via a
scheduled task and communicates with a remote server to download
additional payloads, including Cobalt Strike Beacon for follow-on
reconnaissance activity.

It also carries out lateral movement across the network and
executes the same Cobalt Strike Beacon in all those workstations,
and then proceeds to install Atera agent^[11], a legitimate remote
administration tool, as a redundant remote access mechanism.

“Utilizing IT tools like this allows attackers to create an
additional ‘backdoor’ for themselves in the event their initial
persistence mechanisms are discovered and remediated,” the
researchers said. “These tools are less likely to be detected by
antivirus or EDR and are also more likely to be written off as
false positives.”

The Cobalt Strike Beacon is further used as a conduit to
download a C# tool dubbed Rubeus^[12] for credential theft,
ultimately permitting the threat actor to move laterally to a
Windows Server with domain admin privileges.

The elevated permissions are then weaponized to stage a DCSync attack^[13], allowing the adversary
to simulate the behavior of a domain controller (DC) and retrieve
credentials from other domain controllers.

Other tools used as part of the attack include a legitimate
utility named netscan.exe to scan the network for lateral movement
as well as the rclone file syncing software to exfiltrate
directories of interest to the MEGA cloud storage service.

The findings come as researchers from Team Cymru shed more light
on the BackConnect (BC) protocol used by IcedID to deliver
additional functionality post compromise, including a VNC module^[14] that provides a
remote-access channel.

“In the case of BC, there appears to be two operators managing
the overall process within distinct roles,” the researchers
noted^[15] last month, adding
“much of the activity […] occurs during the typical working
week.”

The development also follows a report^[16] from Proofpoint in
November 2022 that a resurgence in Emotet activity has been linked
to the distribution of a new version of IcedID.