ISC Stormcast For Friday, February 24th, 2023 https://isc.sans.edu/podcastdetail.html?id=8384

URL files and WebDAV used for IcedID (Bokbot) infection

Published: 2023-02-24. Last Updated: 2023-02-24 01:37:45 UTC
by Brad Duncan (Version: 1)

Introduction

IcedID (also known as Bokbot) is an information stealer/backdoor malware that can lead to other activity like Cobalt Strike and Virtual Network Computing (VNC) traffic. IcedID is often distributed through email, and we've also seen it delivered by fake software sites from Google ad traffic.

For email-based distribution, we've seen OneNote files as an initial lure this month (here's one example). But these distribution patterns occasionally change. For example, on Tuesday 2023-02-21, we found a distribution pattern using .url files and WebDAV traffic for an IcedID infection.

Today's diary reviews an infection from Thursday 2023-02-23 generated by one of those .url files.

Shown above: Flow chart for the infection activity.

The Discovery

On Tuesday 2023-02-21, @wwp96 tweeted about an open directory at hxxp://104.156.149[.]6/webdav/. Searching VirusTotal revealed at least 22 .url files that attempt to contact the server. These .url files all use file:\\\\ instead of http:// for the URL, and they all grab a similarly-named .bat file from the open directory.

Shown above: URL file and the associated BAT file.

The .bat file runs a DLL installer for IcedID on the same server at \\104.156.149[.]6\webdav\host.dll.

WebDAV Traffic

The .url and .bat files both use WebDAV to retrieve and run the malware. WebDAV stands for "Web Distributed Authoring and Versioning," and it's a set of extensions to the HTTP protocol that allows users to access and edit files on a remote web server.

You can access WebDAV servers using Windows File Explorer. The image below shows what happened when we opened \\104.156.149[.]6\webdav\ in a File Explorer window.

Shown above: Opening the malicious WebDAV server in Windows File Explorer.

This WevDAV activity generated several HTTP PROPFIND and GET requests. While GET requests are seen in almost any HTTP traffic, these PROPFIND requests are specific to WebDAV. Reviewing our pcap of the IcedID infection in Wireshark, we can find several HTTP PROPFIND requests over TCP port 80.

Shown above: Traffic from the infection filtered in Wireshark, highlighting the WebDAV PROPFIND requests.

Following TCP streams for any of the PROPFIND requests reveals a Microsoft WebDAV user agent in the request headers. The WebDAV server returns an XML file with properties of the specified directory or file.

Shown above: TCP stream of a WebDAV PROPFIND request over HTTP.

IcedID Traffic From The Infected Windows Host

After the WebDAV activity, infection traffic was similar to previous IcedID infections. The only unusual activity was an HTTP GET request using cURL to hxxp://mandalorecnote[.]com/images/ caused by the .bat file.

Shown above: Traffic from the infection filtered in Wireshark.

The HTTP GET request to hxxp://mandalorecnote[.]com/images/ returned a 12kB 64-bit DLL. This DLL doesn't appear to be used for the IcedID infection, and a cursory forensic investigation didn't find it saved to disk. It's likely a decoy file or decoy traffic, and the DLL doesn't immediately seem malicious. However, it's still an indicator for this specific wave of IcedID activity.

Shown above: 12 kB DLL returned from mandalorecnote[.]com, possible decoy traffic or file.

Indicators of Compromise (IOCs)

The following are IOCs from the infection we generated on Thursday 2023-02-23.

22 .url files found on VirusTotal that contact the malicious WebDAV server.

Read: SHA256 hash - file name

0a79166f95d1f1a3542135241ea42026188916ea9c06510c20247849c5ad6f0e - PO#56034.url
0dfd67dafe621b57eac338e581d65598197cdb0a499a8345fa9beeae9196d8e8 - PO#15986.url
145b2d2a7d52f6c9ff96fbd2338204a7eb062ed271893faa7ad5a87b0879fa50 - PO#66438.url
1574ed0b6c1b82089dc8fc098acc3bb86c63aa11f24e45c6683a485fe109777a - PO#89932.url
161baa1e72a4f23c9c7fee1431d3fcb07a0fd832a4318c1ebe7526de71baedda - PO#39134.url
1c3ece4a1e0c9cf42a063b76da6d22c1bd43e929ce01cc51d506880b8d86f72f - PO#36627.url
2505d97d1b34bc27e13e6e212fa591866a3a384952d404ceb7c1a8f385ac6238 - PO#84049.url
266c106ef803493a9dc14f48437c482088764ea47eb14214f09d49ad1ad62c71 - PO#31084.url
2bdc4b5aa6b3f9395065f2c31ba130ecc21fbe4db3fcdb3c60a526e34e72bd74 - PO#61467.url
48b05dcb2f48ae742498e040135079a8b59f3698d1619c44622b0fe558760342 - PO#92390.url
4cc43b0ec10ad3f8521504df13f38182d945b865dac070b8663c262ec2b2ed69 - PO#96856.url
5d9ffcd009e5fde1eaa2eb6a2fbead02b3169024401720e2a06e90e3edd10cb9 - PO#37820.url
690b002884d71774f0877ad69385c12d0f814606296c69b647bd19a900cdd768 - PO#66703.url
acc3d0964c41f6553d3aca71ba8baec044a2158ea019ecf50d8fa1d9e6720298 - PO#68631.url
accf567245e184467ead9e9e5a52ab68d7bd0c9eaa81848b439cec69fd808416 - PO#69421.url
b1c1977b5d5b0705fa3e29b9cd5760e2f394698ad9594f626104021893bddc20 - PO#59042.url
c823261b03d11d23e76756643c8ca28baf024353464297346612af908bda4d8e - PO#94545.url
d02a84eb7972ce9e1a092702595750ec687f850ebbd1879a3fe5944f51b24473 - PO#16873.url
d5332249fcef78250100b4a147ef336279f188336f2d543dd5b3638973b107be - PO#84805.url
dcf2a4d0ee66d3f47d9ff4ee9bcbc63c3286559a0ba80ab129034639b063f7f1 - PO#44959.url
f4c46cf9ffd25764a63bcc6d158bfad5495802f830266111a37d39f107eee6d4 - PO#36434.url
fae4e3388e95d2e710257ae86ff482258f0f51458f42d116349ebc6a9266b29f - PO#99805.url

Files from an infected Windows host:

SHA256 hash: 2bdc4b5aa6b3f9395065f2c31ba130ecc21fbe4db3fcdb3c60a526e34e72bd74

File size: 66 bytes
File name: PO#61467.url
File description: Found on VirusTotal, .url file for IcedID used to generate this infection

SHA256 hash: 2c814c61891a1b3b9067b82b5357d13505b4ced6fd827fdde4c3116efb3f9cef

File size: 114 bytes
File location: \\104.156.149[.]6\webdav\PO_61467.bat
File description: .bat file retrieved by the above .url file

SHA256 hash: 6daeb5feb3cf988790b30152a25617566523fad65cbc4846e3a715c2e4dfb307

File size: 12,041 bytes
File location: hxxp://mandalorecnote[.]com/images/
File description: Probable decoy 64-bit DLL file returned from mandalorecnote.com
Note: This DLL doesn't appear to be malicious, and it doesn't seem to be used for the infection, but is still an indicator

SHA256 hash: 8d076fe2d93a9ebd5701eb7a1acab37e9d390df7f50e6d155c6c7289934d2b54

File size: 243,712 bytes
File location: \\104.156.149[.]6\webdav\host.dll
File description: 64-bit DLL installer for IcedID
Run method: rundll32.exe [filename],XSSCheckStart

SHA256 hash: d1ac1a32c791141d89d3df990f95b8011cfc2ec585a8c8715c0bac61e63b1a95

File size: 506,299 bytes
File location: hxxp://ituitem[.]net/
File description: Retrieved by above IcedID installer, gzip binary from ituitem[.]net

SHA256 hash: f2ab26557364d548a40ab3c43db78e03750e8eb391258080dda31b5c3f71c1d9

File location: Data binary used to run persistent IcedID DLL
File description: C:\Users\[username]\AppData\Roaming\ExpandStrong\license.dat

SHA256 hash: a01a82f3edd13700ea85115e553fb7a601b098891cbbebbc94b2289ae40bedce

File size: 220,160 bytes
File location: C:\Users\[username]\AppData\Roaming\Lied2\Ayifoqpw4.dll
File description: Persistent 64-bit DLL for IcedID
Run method: rundll32.exe [filename],#1 --biti="[path to license.dat]"

Traffic from an infected Windows host:

WebDAV traffic generated by .url file:

104.156.149[.]6 port 80 - 104.156.149[.]6 - PROPFIND /webdav HTTP/1.1
104.156.149[.]6 port 80 - 104.156.149[.]6 - PROPFIND /webdav/PO_61467.bat HTTP/1.1
104.156.149[.]6 port 80 - 104.156.149[.]6 - GET /webdav/PO_61467.bat HTTP/1.1

WebDAV traffic generated by PO_61467.bat file:

104.156.149[.]6 port 80 - 104.156.149[.]6 - PROPFIND /webdav/host.dll.manifest HTTP/1.1
104.156.149[.]6 port 80 - 104.156.149[.]6 - PROPFIND /webdav/host.dll HTTP/1.1
104.156.149[.]6 port 80 - 104.156.149[.]6 - GET /webdav/host.dll HTTP/1.1
104.156.149[.]6 port 80 - 104.156.149[.]6 - PROPFIND /webdav/host.dll.123.Manifest HTTP/1.1
104.156.149[.]6 port 80 - 104.156.149[.]6 - PROPFIND /webdav/host.dll.124.Manifest HTTP/1.1
104.156.149[.]6 port 80 - 104.156.149[.]6 - PROPFIND /webdav/host.dll.2.Config HTTP/1.1