Overview

overview

10

Static

static

documents.lnk

windows7_x64

10

documents.lnk

windows10-2004_x64

10

olasius.dll

windows7_x64

3

olasius.dll

windows10-2004_x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    StolenImg.rar

  • Size

    321KB

  • Sample

    220510-scw6yahcf5

  • MD5

    c8eefbc5e111b1fb7da5ca1e2a80a59e

  • SHA1

    ec085dd85a9a2c075f05437318f9d57b30e97d51

  • SHA256

    e843f357788c17351b569fd3ff32cdb91fe498eec76c0397e6c0fcfd978edb53

  • SHA512

    4bee11ba7c1fb1829e59c598d47bb8f15796440cfb117fc5d87e99434edddf54a6b6a89e3325a906acc5a7976a053f2269c275bf374c1e6c4e885a5d197b63d4

Score
10/10
icedid3000901376bankerloadersuricatatrojan

Malware Config

Extracted

Family

icedid

Campaign

3000901376

C2

yolneanz.com

Targets

    • Target

      documents.lnk

    • Size

      1KB

    • MD5

      dc097dea18775a8f3d31b52697dc368e

    • SHA1

      c9d5fe30ac230dc48d450182fb899c9638fb35bb

    • SHA256

      f7861ee8b3917e3746d44a769453334c9bf1b780213634ed9abd42f7873b0593

    • SHA512

      ad34d919b7e8dc014e53c14a3a6c74556a24b1258aec83eb3c5fe584c9c908ba3a11e001319ae22e51173c6908ba6c34e5dde7f4056d0cc753e645ea2310ddb0

    Score
    10/10
    icedid3000901376bankerloadersuricatatrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

    • Target

      olasius.dll

    • Size

      576KB

    • MD5

      2d01a326dcb38cd629b771e35ad3f5d5

    • SHA1

      111af3037c9837e8fb43610e070af474bd9bcbea

    • SHA256

      6c168f840b0af92cc2974a95151d3b21f02c37be9d16225bac03ece6c1404369

    • SHA512

      a3fd2c640a6a478796e06ca88a2b5752ed37ccbae9c419488ccbdef8c344c4379becd2e3d1beda1f3bab4d3b943917a9b23d9e3fea5bb6d3148b0904b8996a76

    Score
    3/10
    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks