Overview

overview

10

Static

static

vict.exe

windows7_x64

10

vict.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    vict.exe

  • Size

    1.5MB

  • Sample

    210404-g51cgwxld6

  • MD5

    1fe5a78b062c229be63d1d69770fb04f

  • SHA1

    220b0f77946840c832f6913ae05a1bbe26c95e54

  • SHA256

    fc79c071ab08ab2fe68ac0361e340d8e3fc047d823392e4d3df25823d22acf78

  • SHA512

    23aedb7bdc329469f0e577eb44a0a0d8da59c6d5bc6c5f77a51378640ebe2772217e61f81ab060473e7a03e97554fdd9392254860c2b61d212cb2e99aa1eee1e

Score
10/10
icedid2412332838bankerdiscoveryloadertrojan

Malware Config

Extracted

Family

icedid

Campaign

2412332838

C2

gaaga923.website

Targets

    • Target

      vict.exe

    • Size

      1.5MB

    • MD5

      1fe5a78b062c229be63d1d69770fb04f

    • SHA1

      220b0f77946840c832f6913ae05a1bbe26c95e54

    • SHA256

      fc79c071ab08ab2fe68ac0361e340d8e3fc047d823392e4d3df25823d22acf78

    • SHA512

      23aedb7bdc329469f0e577eb44a0a0d8da59c6d5bc6c5f77a51378640ebe2772217e61f81ab060473e7a03e97554fdd9392254860c2b61d212cb2e99aa1eee1e

    Score
    10/10
    icedid2412332838bankerdiscoveryloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • IcedID First Stage Loader

      loader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks