Overview

overview

10

Static

static

8

intelligen...21.doc

windows7_x64

10

intelligen...21.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    intelligence,05.06.21.doc

  • Size

    75KB

  • Sample

    210506-yvaflty43s

  • MD5

    b099701b7b7724a72a02fd847bc8fe70

  • SHA1

    2385b9d3aa12d4c7ed4b8601cfeede5c445f0d1a

  • SHA256

    83dbeb39be0b373bc8ea3c34c2ea78c5750a48bc1ac7699c84890f30e8e912bc

  • SHA512

    8831d6304a1d748446f05e68af008d22c711881fa44214509aa16aec935afc5eeb66a7db9e1c7a275a69479985d263d7e5408fc95a327e1c1ae08c48784c1d8b

Score
10/10
icedid2941843931bankermacrotrojan

Malware Config

Extracted

Family

icedid

Campaign

2941843931

C2

barcafokliresd.top

Targets

    • Target

      intelligence,05.06.21.doc

    • Size

      75KB

    • MD5

      b099701b7b7724a72a02fd847bc8fe70

    • SHA1

      2385b9d3aa12d4c7ed4b8601cfeede5c445f0d1a

    • SHA256

      83dbeb39be0b373bc8ea3c34c2ea78c5750a48bc1ac7699c84890f30e8e912bc

    • SHA512

      8831d6304a1d748446f05e68af008d22c711881fa44214509aa16aec935afc5eeb66a7db9e1c7a275a69479985d263d7e5408fc95a327e1c1ae08c48784c1d8b

    Score
    10/10
    icedid2941843931bankertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks