icedid | 807fb8634a8e1fea7d7927dd6b00a351e51b8533009d76184a930f41ebcbcf49 | Triage

Submit
Reports

Overview

overview

Static

static

8

mvsdocumen...2.docm

windows7-x64

mvsdocumen...2.docm

windows10-2004-x64

Sharing

General

Target

mvsdocument09.26.2022.doc
Size

866KB
Sample

220926-v3pwnabea8
MD5

b48acfc1e413b37d29e7284e4dc059f4
SHA1

0518c18f78faf9e97be202a9c530f9725c389163
SHA256

807fb8634a8e1fea7d7927dd6b00a351e51b8533009d76184a930f41ebcbcf49
SHA512

caf3c65a764476b014c028713e4ed2b5642d762554592320c660d3a43a62535ba5806e3e61587b91b91d67123d59c233f48af0a4ae3a077d02d42ac19c9bb003
SSDEEP

12288:TJVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DESaYjfH9lvYz9Q6d6:tV2jUeQRI5wPN//a0fHAz9QX

Score

10^/10

icedid 742081363 banker loader macro trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

mvsdocument09.26.2022.docm

Resource

win7-20220812-en

icedid 742081363 banker trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

mvsdocument09.26.2022.docm

Resource

win10v2004-20220812-en

icedid 742081363 banker loader trojan

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Extracted

Family

icedid

Campaign

742081363

Extracted

Family

icedid

Campaign

742081363

C2

scainznorka.com

Targets

- Target
  
  mvsdocument09.26.2022.doc
- Size
  
  866KB
- MD5
  
  b48acfc1e413b37d29e7284e4dc059f4
- SHA1
  
  0518c18f78faf9e97be202a9c530f9725c389163
- SHA256
  
  807fb8634a8e1fea7d7927dd6b00a351e51b8533009d76184a930f41ebcbcf49
- SHA512
  
  caf3c65a764476b014c028713e4ed2b5642d762554592320c660d3a43a62535ba5806e3e61587b91b91d67123d59c233f48af0a4ae3a077d02d42ac19c9bb003
- SSDEEP
  
  12288:TJVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DESaYjfH9lvYz9Q6d6:tV2jUeQRI5wPN//a0fHAz9QX
Score

10^/10

icedid 742081363 banker trojan loader
- IcedID, BokBot
  IcedID is a banking trojan capable of stealing credentials.
  trojan banker icedid
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

icedid742081363bankertrojan

behavioral2

icedid742081363bankerloadertrojan

© 2018-2024

Terms | Privacy