Overview

overview

10

Static

static

documents.lnk

windows7_x64

10

documents.lnk

windows10-2004_x64

10

s4pesa.dll

windows7_x64

10

s4pesa.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    zippedISO_20220629.zip

  • Size

    419KB

  • Sample

    220629-qs211sbec9

  • MD5

    56eb5a0b6bf34a0fd5acacfed153ffef

  • SHA1

    2359ad3743a85598f9fe06d94c6e577879ec2600

  • SHA256

    e5451e56bbadaf208e57ce1562edfeeae1f7eae2b6fe8d0a92cf29e48cfafa7c

  • SHA512

    21007e9c612c7a8feff4d0f1cb57c465652caec41bbb07d1b185a783f9539fd874942719bb862e80832a7ea3b71a6b681a84e34f598d3ecb89781ca4e103b307

Score
10/10
icedid3652318967bankerloadersuricatatrojan

Malware Config

Extracted

Family

icedid

Campaign

3652318967

C2

yankyhoni.com

Targets

    • Target

      documents.lnk

    • Size

      2KB

    • MD5

      77e1106d0ee3c074c5aa94663e62ca8c

    • SHA1

      5149a36f2934cbe44a7066e96756d4ecb7a65cbd

    • SHA256

      4633c5e89c5c9e60c3609dfb7f5ca1f0794c2b84c3468cdc2129d942d4e09cf3

    • SHA512

      8644ef5ca3082bf4f062e53bdba5231f5b010c90fae919bb76f16dc46dae10a76e3ef94dca6d6ae709b4aaeb39b80eedbdc41298fc8d561e0561a51cde9575e6

    Score
    10/10
    icedid3652318967bankerloadersuricatatrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

    • Target

      s4pesa.dll

    • Size

      731KB

    • MD5

      aee5edbcfafb2c7a64ae6fece8de9e97

    • SHA1

      446dd83a84b7eb5aac762017396b0a7b8776b7a3

    • SHA256

      3576cdf797b23022feb4ec7eb4ff7b87d3a79a04574e35893efce871b0a7c92c

    • SHA512

      495320cc7a3ba699df1fd7e5f1df76d1a5debe1320246eb0e644d9692d7692d69aea9e3185cefbd9e54a68f2f9b4d0497f1a71a2b7d9aeb345369cc777859692

    Score
    10/10
    icedid3652318967bankerloadersuricatatrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata

    • Blocklisted process makes network request

    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks