Threat Intelligence Analysis: IcedID — Tracking a Macro-Enabled Document Delivery Chain
Platform: CyberDefenders Challenge: IcedID Category: Threat Intelligence Difficulty: Easy Tools: VirusTotal, Malpedia, X (Twitter), Tria.ge, ANY.RUN Achievement: Proof of Completion
1. Executive Summary
Incident Type: Malware Delivery / Banking Trojan / Threat Intelligence Pivot
Malware Family: IcedID (BokBot)
A suspicious file was flagged during threat intelligence triage. Using open-source threat intelligence platforms — VirusTotal, Tria.ge, Malpedia, and ANY.RUN — the investigation confirmed the file as a macro-enabled Excel document weaponized with XLM 4.0 macros. The document serves as a first-stage loader for the IcedID (also known as BokBot) banking trojan. The delivery infrastructure utilizes multiple compromised domains serving payloads disguised as GIF files, and the campaign is attributed to the financially motivated threat group TA551 (also tracked as GOLD CABIN / Shathak).
Indicators of Compromise (IOCs)
| Type | Indicator | Description |
|---|---|---|
| Malware Hash (SHA-1) | 191eda0c539d284b29efe556abb05cd75a9077a0 | Initial hash submitted for analysis |
| Malware Hash (SHA-256) | d86405130184186154daa4a5132dd1364ab05d1f14034c7f0a0cda690a91116d | Full SHA-256 of the malicious XLSX |
| File Name | document-1982481273.xlsm | Social-engineered document filename |
| Payload URL (1) | metaflip[.]io/ds/3003.gif | XLM macro payload download URL |
| Payload URL (2) | partsapp[.]com[.]br/ds/3003.gif | Redundant payload download URL |
| Payload URL (3) | columbia[.]aula-web[.]net/ds/3003.gif | Redundant payload download URL |
| Payload URL (4) | tajushariya[.]com/ds/3003.gif | Redundant payload download URL |
| Payload URL (5) | agenbolatermurah[.]com/ds/3003.gif | Redundant payload download URL |
| Dropped File | ksjvoefv.skd | Renamed payload dropped to disk |
| Domain Registrar | NameCheap, Inc. | Registrar used for C2 domain infrastructure |
| Threat Group | TA551 (G0127) / GOLD CABIN / Shathak | Attribution via MITRE ATT&CK |
| Macro Language | XLM 4.0 | Legacy Excel macro language used for evasion |
MITRE ATT&CK Mapping Overview
| Tactic | Technique | ID |
|---|---|---|
| Initial Access | Phishing: Spearphishing Attachment | T1566.001 |
| Execution | User Execution: Malicious File | T1204.002 |
| Execution | Command and Scripting Interpreter: XLM Macros | T1059 |
| Defense Evasion | Masquerading: Match Legitimate Name (.gif extension) | T1036.005 |
| Defense Evasion | Obfuscated Files or Information | T1027 |
| Command & Control | Ingress Tool Transfer | T1105 |
2. Background: The IcedID Delivery Model
IcedID (also known as BokBot) is a modular banking trojan that first emerged in 2017. While originally designed for credential theft and web injection against financial institutions, it has evolved into a versatile initial access broker — frequently delivering secondary payloads like Cobalt Strike, Conti ransomware, and other post-exploitation frameworks.
| Component | Description | Forensic Significance |
|---|---|---|
| XLM 4.0 Macros | Legacy Excel macro language predating VBA | Evades many modern AV/EDR solutions that focus on VBA analysis |
| Staged Payload Download | Multiple redundant URLs serving the same payload | Ensures delivery even if individual domains are blocked |
.gif Extension Masquerading | Payloads served with image file extensions | Bypasses file-type-based web proxies and URL filters |
| TA551 / Shathak | Financially motivated threat group (MITRE G0127) | Known for high-volume email campaigns distributing IcedID and other loaders |
Why This Matters: IcedID’s use of XLM 4.0 macros instead of modern VBA is a deliberate evasion technique. Many security tools and sandboxes focus their macro analysis on VBA, leaving XLM macros — a 30-year-old technology — as a blind spot. Analysts must ensure their analysis tools support XLM macro extraction (e.g.,
olevba,XLMMacroDeobfuscator).
3. Phase 1: Initial Sample Triage — VirusTotal Analysis (Questions 1–4)
Objective: Identify the malware family, file type, threat labels, and delivery filenames using VirusTotal.
The investigation begins with the provided SHA-1 hash 191eda0c539d284b29efe556abb05cd75a9077a0. Submitting this hash to VirusTotal immediately reveals the sample’s reputation and classification.
Key findings from VirusTotal:
- 44/65 vendors flag the file as malicious — extremely high consensus
- Popular threat label:
trojan.x97m/docdl— thex97mprefix indicates Excel macro content - Family labels:
x97m,docdl,icedid— confirming this is an IcedID downloader - File size: 105.53 KB — small enough to evade size-based email filters
The Details tab reveals the various filenames this sample has been observed under:
The filename document-1982481273.xlsm is a classic social engineering pattern — a generic “document” prefix followed by a random number, designed to look like an auto-generated file from a legitimate business system (e.g., invoice processing, document management).
Identifying Dropped Files
The Behavior tab in VirusTotal reveals the files dropped to disk when the macro executes:
The macro downloads payloads disguised as .gif files (cached in inetcache\ie\) and renames them to .skd files on disk. The filename ksjvoefv.skd is the final payload dropped to the user’s profile directory — a randomized name with a non-standard extension designed to avoid detection by filename-based rules.
Answer Q1
What is the malware family classification for the file?
IcedID
Answer Q2
What is the file type of the malicious sample?
xlsx
Answer Q3
What is the document file name used for social engineering?
document-1982481273.xlsm
Answer Q4
What is the name of the file dropped to disk?
ksjvoefv.skd
4. Phase 2: Infrastructure Analysis — Contacted URLs & Download Chain (Questions 5 & 6)
Objective: Map the download infrastructure used by the macro to retrieve the IcedID payload.
The Relations tab in VirusTotal reveals the external URLs the macro contacts when executed. This provides a complete picture of the attacker’s delivery infrastructure:
Five different compromised domains all serve the same payload path (/ds/3003.gif), providing redundancy — if one domain is taken down, the macro simply falls back to the next URL in the CALL sequence. The .gif extension is a deliberate masquerade: these are not image files but rather the IcedID DLL payload renamed to bypass URL filtering rules that block executable downloads.
Sandbox Confirmation via Tria.ge
Cross-referencing the sample on Tria.ge (Recorded Future Sandbox) confirms the XLM macro source code and the exact download CALL sequence:
The extracted XLM macro source confirms the delivery mechanism:
CALL("URLMon", "URLDownloadToFileA")— Uses the WindowsURLMonCOM object to download files- Each call targets a different compromised domain with the same path
/ds/3003.gif - Downloaded files are saved locally as
..\ksjvoefv.skd,..\ksjvoefv.skd1,..\ksjvoefv.skd2, etc.
Analyst Note: The use of
URLDownloadToFileAfrom XLM macros is a well-known technique. Detection engineers should create Sigma/YARA rules targeting Excel processes (excel.exe) making outbound HTTP connections viaurlmon.dll— this is almost never legitimate in an enterprise environment.
Answer Q5
How many URLs did the malware contact?
8
Answer Q6
What is the registrar used for the domain infrastructure?
NameCheap, Inc.
5. Phase 3: Threat Attribution — MITRE ATT&CK & Malpedia (Questions 7 & 8)
Objective: Attribute the campaign to a known threat actor using open-source threat intelligence frameworks.
WHOIS Pivot on C2 Domains
Examining the WHOIS history for one of the payload domains (tajushariya.com) reveals consistent registration through NameCheap, Inc. — a registrar frequently used by threat actors due to its low cost and minimal verification requirements:
|  |
Threat Actor Attribution via Malpedia & MITRE ATT&CK
Pivoting to Malpedia and the MITRE ATT&CK framework, IcedID is cataloged as software S0483. The “Groups That Use This Software” section directly links IcedID to two threat groups:
TA551 (MITRE ID: G0127, also known as GOLD CABIN and Shathak) is a financially motivated threat group active since at least 2018. They are known for high-volume email-based malware distribution campaigns targeting English, German, Italian, and Japanese speakers.
Answer Q7
What threat group is associated with IcedID distribution?
TA551
Answer Q8
What is the MITRE ATT&CK group ID for the associated threat actor?
G0127
6. Reconstructed Attack Flow
Based on the multi-platform threat intelligence analysis, we can reconstruct the complete IcedID delivery chain:
| Step | Kill Chain Phase | Action | Evidence Source |
|---|---|---|---|
| 1 | Weaponization | TA551 creates document-1982481273.xlsm with embedded XLM 4.0 macros | Tria.ge macro extraction |
| 2 | Delivery | Document delivered via spearphishing email attachment | TA551 known TTP (Malpedia) |
| 3 | Exploitation | Victim opens document and enables macros | User execution required |
| 4 | Installation | XLM macro calls URLDownloadToFileA to download 3003.gif from 5 redundant domains | VirusTotal Contacted URLs |
| 5 | Installation | Payload saved as ksjvoefv.skd in user profile directory | VirusTotal Behavior → Dropped Files |
| 6 | C2 | IcedID DLL loaded, begins C2 communication for banking credential theft | IcedID known behavior (Malpedia) |
Key Observation: The attack chain relies entirely on social engineering — there are no software exploits involved. The XLM macro only executes if the user manually clicks “Enable Content.” However, the 44/65 VirusTotal detection rate means many enterprise AV solutions do detect this sample. The real danger lies in campaigns using fresher variants with lower detection rates, delivered within hours of compilation before AV signatures are updated.
7. Conclusion
The IcedID investigation demonstrates a complete threat intelligence workflow — from hash submission to threat actor attribution. Key findings:
- Malware Family: IcedID (BokBot) banking trojan, delivered via a macro-enabled Excel document (
document-1982481273.xlsm). - Evasion Technique: XLM 4.0 macros used instead of VBA to evade modern macro analysis tools.
- Delivery Infrastructure: Five compromised domains serving identical payloads at
/ds/3003.gifwith.gifextension masquerading. - Attribution: Campaign attributed to TA551 (G0127 / GOLD CABIN / Shathak) — a prolific financially motivated threat group.
- Registrar Pattern: All C2 domains registered through NameCheap, Inc.
Key Takeaways for the SOC:
- Block the identified payload URLs and their parent domains at the web proxy and DNS sinkhole level. Add all 5 compromised domains to the blocklist immediately.
- Deploy XLM macro detection rules — many organizations disable VBA macros via Group Policy but forget that XLM 4.0 macros are a separate, older technology that must be disabled independently (
Excel > Trust Center > Macro Settings > Disable Excel 4.0 macros). - Hunt for
urlmon.dllactivity from Office processes — Sigma rules detectingexcel.exeorwinword.exeloadingurlmon.dlland making outbound HTTP connections are a reliable detection for macro-based downloaders. - Monitor for NameCheap-registered domains in newly observed DNS queries — while NameCheap is legitimate, its prevalence in threat actor infrastructure makes it a useful enrichment signal when combined with other indicators.
Analysis Date: June 21, 2026 Analyst: El OMARI Zakaria