icedid | 5cc55537a511195f7156af0e5ba37f4b02c124e2e2576561a50efbb23c7e1ed6 | Triage

Submit
Reports

Overview

overview

Static

static

8

iowateleco...2.docm

windows7-x64

iowateleco...2.docm

windows10-2004-x64

Sharing

General

Target

iowatelecom,document,09.26.2022.doc
Size

865KB
Sample

220926-v7p28acfcn
MD5

54099e7be024c3faff908fcffb6ca6cb
SHA1

de5e212c5345b57fb61f0981767f222587c71483
SHA256

5cc55537a511195f7156af0e5ba37f4b02c124e2e2576561a50efbb23c7e1ed6
SHA512

76993fcc0d9877845efb0d0bbfc6d4b7cef20e0eece4d0d2b15fa181de5dab340f5526be09eb6708113918e786760ebf51a75b81d1cf909e79fca991eecdd517
SSDEEP

12288:AVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEHhI+FG9RFt6eGc2rh3XDRe:AV2jUeQRI5wPN/2I+Fint6RdRe

Score

10^/10

icedid 742081363 banker loader macro trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

iowatelecom,document,09.26.2022.docm

Resource

win7-20220812-en

icedid 742081363 banker trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

iowatelecom,document,09.26.2022.docm

Resource

win10v2004-20220812-en

icedid 742081363 banker loader trojan

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Extracted

Family

icedid

Campaign

742081363

Extracted

Family

icedid

Campaign

742081363

C2

scainznorka.com

Targets

- Target
  
  iowatelecom,document,09.26.2022.doc
- Size
  
  865KB
- MD5
  
  54099e7be024c3faff908fcffb6ca6cb
- SHA1
  
  de5e212c5345b57fb61f0981767f222587c71483
- SHA256
  
  5cc55537a511195f7156af0e5ba37f4b02c124e2e2576561a50efbb23c7e1ed6
- SHA512
  
  76993fcc0d9877845efb0d0bbfc6d4b7cef20e0eece4d0d2b15fa181de5dab340f5526be09eb6708113918e786760ebf51a75b81d1cf909e79fca991eecdd517
- SSDEEP
  
  12288:AVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEHhI+FG9RFt6eGc2rh3XDRe:AV2jUeQRI5wPN/2I+Fint6RdRe
Score

10^/10

icedid 742081363 banker trojan loader
- IcedID, BokBot
  IcedID is a banking trojan capable of stealing credentials.
  trojan banker icedid
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

icedid742081363bankertrojan

behavioral2

icedid742081363bankerloadertrojan

© 2018-2024

Terms | Privacy