Extracted

• • Target
    enjoin,12.27.2021.doc
  • Size 77KB
  • SHA256 ecd84fa8d836d5057149b2b3a048d75004ca1a1377fcf2f5e67374af3a1161a0
  • MD5 7044bd240219ec2f83b01c532e2ce5ba
  • SHA1 745cdbc4a826c5960eef3f4a9aa307ff94e4b7fb
  • SHA512 8467fc9f63711c8fa460f1f35d42b6528c6e285799d9a19630696dd3a12e24799370eaa6d53e075e60d579a3b4ecef035cf62aac6a1bc96130b392c3931882ee
  • MD5 SHA1 SHA512

  Score

  10^/10

  icedid2507181075bankersuricatatrojan

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Loads dropped DLL

  behavioral1behavioral2