Overview

overview

10

Static

static

1bc6dc2bd7...73.exe

windows7_x64

10

1bc6dc2bd7...73.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1bc6dc2bd7d420c49f410a30bbcf786a7c68a7e324145487edfc8dfb324c6473.zip

  • Size

    231KB

  • Sample

    220223-v21lrsahd3

  • MD5

    0b5a99e6c739dc01feaf13aac70c6eac

  • SHA1

    e6e31b72fdeedd59af8d24afd4af6dd2c53f8110

  • SHA256

    60a4c4bd4123ceeaa0e9806aa63dceb164091583112ba166d7708335f35edb8c

  • SHA512

    24ed28f6a23a271ac009f6c546c30ec61f106c935a59318315cfcbd983ada823545d08d96c69c77211e460cdcede03de6de88e0a67a3f1fc0c4934182e1ca591

Score
10/10
icedidsmokeloader1843818144backdoorbankerevasionloaderpersistencetrojanupx

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://dollybuster.at/upload/

http://spaldingcompanies.com/upload/

http://remik-franchise.ru/upload/

http://fennsports.com/upload/

http://am1420wbec.com/upload/

http://islamic-city.com/upload/

http://egsagl.com/upload/

http://mordo.ru/upload/

http://piratia-life.ru/upload/

https://oakland-studio.video/search.php

https://seattle-university.video/search.php
rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

icedid

Campaign

1843818144

C2

grendafolz.com

Targets

    • Target

      1bc6dc2bd7d420c49f410a30bbcf786a7c68a7e324145487edfc8dfb324c6473

    • Size

      347KB

    • MD5

      5e0e9e8a5a59e34b24ae82afb780ee1b

    • SHA1

      b7fcc73c90fc8abdccd0cdd1c2ff306a497461cc

    • SHA256

      1bc6dc2bd7d420c49f410a30bbcf786a7c68a7e324145487edfc8dfb324c6473

    • SHA512

      d7ad21283e25d2b4a6860a23723a7bb7cd3f570471b8072310aa01c321123a2d6dba7fd5b8508431db41d3b75d1d3abcc559160511b8886a6621de862abed502

    Score
    10/10
    icedidsmokeloader1843818144backdoorbankerloadertrojanupxevasionpersistence

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • IcedID First Stage Loader

      loader

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies AppInit DLL entries

      persistence

    • Modifies Windows Firewall

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks