icedid | 7fc1d7ba1c77dc2d93a982ea92db6c81d2af658d5ba5116c7167fa82614d114b | Triage

Submit
Reports

Overview

overview

Static

static

8

kingwoodca...6.docm

windows7-x64

kingwoodca...6.docm

windows10-2004-x64

Sharing

General

Target

kingwoodcable-document-09.26.doc
Size

867KB
Sample

220926-v7p28abeb9
MD5

0ef1a9a3a21786ecfa41b2dde315f262
SHA1

721205a2bbe8bcdadc17dfd4fbb1f724642a1206
SHA256

7fc1d7ba1c77dc2d93a982ea92db6c81d2af658d5ba5116c7167fa82614d114b
SHA512

522007c6f0f85452c427ba3b70960a1078a7627880e286df1d08d13f54902ed2f5d5e58a7b74c32653d527ba78039653c96a8fba6f29c5654743273a357f1cb6
SSDEEP

12288:20uVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DE5fHhmuVOkGnCNl+lmqej:20uV2jUeQRI5wPN/UBmZDd6

Score

10^/10

icedid 742081363 banker loader macro trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

kingwoodcable-document-09.26.docm

Resource

win7-20220812-en

icedid 742081363 banker trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

kingwoodcable-document-09.26.docm

Resource

win10v2004-20220901-en

icedid 742081363 banker loader trojan

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Extracted

Family

icedid

Campaign

742081363

Extracted

Family

icedid

Campaign

742081363

C2

scainznorka.com

Targets

- Target
  
  kingwoodcable-document-09.26.doc
- Size
  
  867KB
- MD5
  
  0ef1a9a3a21786ecfa41b2dde315f262
- SHA1
  
  721205a2bbe8bcdadc17dfd4fbb1f724642a1206
- SHA256
  
  7fc1d7ba1c77dc2d93a982ea92db6c81d2af658d5ba5116c7167fa82614d114b
- SHA512
  
  522007c6f0f85452c427ba3b70960a1078a7627880e286df1d08d13f54902ed2f5d5e58a7b74c32653d527ba78039653c96a8fba6f29c5654743273a357f1cb6
- SSDEEP
  
  12288:20uVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DE5fHhmuVOkGnCNl+lmqej:20uV2jUeQRI5wPN/UBmZDd6
Score

10^/10

icedid 742081363 banker trojan loader
- IcedID, BokBot
  IcedID is a banking trojan capable of stealing credentials.
  trojan banker icedid
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

icedid742081363bankertrojan

behavioral2

icedid742081363bankerloadertrojan

© 2018-2024

Terms | Privacy