icedid | 84558e229b112f64c102cb38404f83d6f865ef89df90ffd83d8bbb60e8427dde

General

Target
documents-95598302.xlsm
Size 92KB
Sample210402-pm15b7cdxj
SHA256 84558e229b112f64c102cb38404f83d6f865ef89df90ffd83d8bbb60e8427dde
MD5 bb89c6f12bb7e6615bab48b1af6fa0f0
SHA1 4aa28ceddfa9de92dfd72a351575fa46c6e1d942
SHA512 22c1c9c1fbae067aff69a13e65383ac04174e3208ed8a530f20c6a3d4de162bce363ec781a39eea66480aef2eae9adfa8c7c7d4708872b7891ca7dbd7b105d99
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper
https://jaishritours.com/ds/0204.gif
xlm40.dropper
https://digitalcreations.co.in/ds/0204.gif
xlm40.dropper
https://unityindiversity.in/ds/0204.gif
xlm40.dropper
https://utabmis.ac.rw/ds/0204.gif
xlm40.dropper
https://pinkpaprika.co.uk/ds/0204.gif

Extracted

Family

icedid

Campaign

3666796105

C2

nenepepe.pro

Targets

- Target
  documents-95598302.xlsm
- Size 92KB
- SHA256 84558e229b112f64c102cb38404f83d6f865ef89df90ffd83d8bbb60e8427dde
- MD5 bb89c6f12bb7e6615bab48b1af6fa0f0
- SHA1 4aa28ceddfa9de92dfd72a351575fa46c6e1d942
- SHA512 22c1c9c1fbae067aff69a13e65383ac04174e3208ed8a530f20c6a3d4de162bce363ec781a39eea66480aef2eae9adfa8c7c7d4708872b7891ca7dbd7b105d99
- MD5 SHA1 SHA512
Score

10^/10

icedid 3666796105 banker loader trojan
- IcedID, BokBot
  IcedID is a banking trojan capable of stealing credentials.
  trojan banker icedid
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- IcedID First Stage Loader
  loader
- Blocklisted process makes network request
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

IcedID, BokBot

Process spawned unexpected child process

IcedID First Stage Loader

Blocklisted process makes network request

Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2