Overview

overview

10

Static

static

documents.lnk

windows7_x64

10

documents.lnk

windows10-2004_x64

10

s4pesa.dll

windows7_x64

10

s4pesa.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    zippedISO2_20220629.zip

  • Size

    419KB

  • Sample

    220629-sct2kscag3

  • MD5

    a195f97ac5324ae7399c2e1b7032632c

  • SHA1

    20de1f21975bafd8c65cfa01e9a755d5edb5e3d7

  • SHA256

    509894489774d018fa5b6bea3c27307559a294cc4a6743800b65877e68dce0a0

  • SHA512

    753a0aaf3191585448c1190403f5fea741f7d041956c69c1e5556b5442ccc4a0c17eebe8a5d6de461713a9667d647dbe01f5254d8d2179f364870a4ba8dc73ef

Score
10/10
icedid3652318967bankerloadersuricatatrojan

Malware Config

Extracted

Family

icedid

Campaign

3652318967

C2

yankyhoni.com

Targets

    • Target

      documents.lnk

    • Size

      2KB

    • MD5

      77e1106d0ee3c074c5aa94663e62ca8c

    • SHA1

      5149a36f2934cbe44a7066e96756d4ecb7a65cbd

    • SHA256

      4633c5e89c5c9e60c3609dfb7f5ca1f0794c2b84c3468cdc2129d942d4e09cf3

    • SHA512

      8644ef5ca3082bf4f062e53bdba5231f5b010c90fae919bb76f16dc46dae10a76e3ef94dca6d6ae709b4aaeb39b80eedbdc41298fc8d561e0561a51cde9575e6

    Score
    10/10
    icedid3652318967bankerloadersuricatatrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

    • Target

      s4pesa.dll

    • Size

      731KB

    • MD5

      85385ece7406ae8b3628e3a27098ddb9

    • SHA1

      6d9e54eaf9048628303055faf01910932bb32b9d

    • SHA256

      e85bbe0699df2c1ed14d3c409d082b94a04a1839d4bd00ddcbc5cb64f9849ec1

    • SHA512

      feb4e639a0d6207b1ae57e9202b79542529b0b96e9965f48f6a2fd3080c1b08f340e1bf3b82bb3fc978810de0df202e07ab33c811647f5f533dac766ec37e17c

    Score
    10/10
    icedid3652318967bankerloadersuricatatrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata: ET MALWARE Win32/IcedID Request Cookie

      suricata

    • Blocklisted process makes network request

    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks