Overview

overview

10

Static

static

MAT/AWESOME.cmd

windows7-x64

1

MAT/AWESOME.cmd

windows10-2004-x64

1

MAT/PPM.dll

windows7-x64

10

MAT/PPM.dll

windows10-2004-x64

10

documents048.lnk

windows7-x64

3

documents048.lnk

windows10-2004-x64

5

Sharing

Copy URL Twitter E-mail

General

  • Target
    Stolen_ImagesEvidence_08-25-2022_11-31-48.zip
  • Size 220KB
  • Sample220825-nnvd9sdcf2
  • SHA256 4d17d739f32bb61e52d6f343b1ba81d1c5eb9c804a8f568a286f42da8f62d7f2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
icedid3340526546bankerloadertrojan

Malware Config

Extracted

Family

  • icedid

Campaign

  • 3340526546

C2

  • satisfyammyz.com

Targets

    • Target
      MAT/AWESOME.cmd
    • Size 121B
    • SHA256 9b9a5b560e5a70db8aba3cad39502b2d4e62c212e61ccc60e8429db4be614345
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral1behavioral2
    • Target
      MAT/PPM.DAT
    • Size 269KB
    • SHA256 e117e8fd4b505fe240c60ab04870e9548d785b425a7946c3971df1c3ecdcf33e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    icedid3340526546bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    behavioral3behavioral4
    • Target
      documents048.lnk
    • Size 1KB
    • SHA256 067900ab60a747a380c0f81cd711e2db4df01db3a07970310ba145151f00929b
    • MD5 SHA1 SHA512
    Score
    5/10

    • Drops file in System32 directory

    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks