icedid | a0914ae7b12a78738b47a8c48b844db99ceb902b835274500eb07101cce540f0

General

Target

Cube_WW14.bmp
Size

403KB
Sample

211024-eqjk4sdac5
MD5

7c53b803484c308fa9e64a81afba9608
SHA1

f5c658a76eee69bb97b0c10425588c4c0671fcbc
SHA256

a0914ae7b12a78738b47a8c48b844db99ceb902b835274500eb07101cce540f0
SHA512

5ee38abde2a0e0d419806b21f7b5a2807c27a210b863999ea5e1e5f8785cd24e53d7cae4f13727eb2304e71a85f7cc544029f67eb7eff2e1ed9634105ba9cb11

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/

rc4.i32

Extracted

Family

icedid

Campaign

1875681804

Targets

- Target
  
  Cube_WW14.bmp
- Size
  
  403KB
- MD5
  
  7c53b803484c308fa9e64a81afba9608
- SHA1
  
  f5c658a76eee69bb97b0c10425588c4c0671fcbc
- SHA256
  
  a0914ae7b12a78738b47a8c48b844db99ceb902b835274500eb07101cce540f0
- SHA512
  
  5ee38abde2a0e0d419806b21f7b5a2807c27a210b863999ea5e1e5f8785cd24e53d7cae4f13727eb2304e71a85f7cc544029f67eb7eff2e1ed9634105ba9cb11
Score

10^/10

evasion spyware stealer trojan icedid smokeloader socelars 1875681804 backdoor banker discovery persistence
- IcedID, BokBot
  IcedID is a banking trojan capable of stealing credentials.
  trojan banker icedid
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars Payload
- Suspicious use of NtCreateProcessExOtherParentProcess
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2