Resubmissions

09-12-2021 17:57

211209-wj1dqaeedq 10

06-12-2021 09:45

211206-lrasxsgeh3 3

22-11-2021 13:35

211122-qvrytsfehq 3

Analysis

  • max time kernel
    119s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    09-12-2021 17:57

General

  • Target

    2.exe

  • Size

    177KB

  • MD5

    20478d2d2b86e6c8c9da84af39fd652b

  • SHA1

    f9c926efee370218d0d82dd75e703f46355e6018

  • SHA256

    33fd2f2b2053150f21129807c381d38874c7622d207a8d036782db82cc61455b

  • SHA512

    a348e4d5245b6aff3242f02f66415874a6380fa26740ed18ff2e995a87a386acc2e93182066abc3d6e7dc253909ed79099db70209ca38f779adb7fe67c78b613

Malware Config

Extracted

Family

icedid

Campaign

862604275

C2

nchestothe.ink

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2.exe
    "C:\Users\Admin\AppData\Local\Temp\2.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    PID:1212

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1212-54-0x000007FFFFFA0000-0x000007FFFFFA9000-memory.dmp

    Filesize

    36KB