icedid | 0b1b3f889461485e71868160f46aeb008d8dd68c44b7b2e2f6f2c3e8831aae8b | Triage

Submit
Reports

Overview

overview

Static

static

8

kinizamail...2.docm

windows7-x64

kinizamail...2.docm

windows10-2004-x64

Sharing

General

Target

kinizamail-doc-09.26.22.doc
Size

867KB
Sample

220926-v8ac6abec6
MD5

127a837bbe912f144fd3c98148308459
SHA1

06d87666a996908807e373a9a7569f24cf6c2e17
SHA256

0b1b3f889461485e71868160f46aeb008d8dd68c44b7b2e2f6f2c3e8831aae8b
SHA512

0cf93803d016f5694e2d428845bdfb582538a91b0d61e17883283f8a982384c6ab30e72fac6aad7cd5d60e26bc96dc24754b140127c1768bd532f8a7d57e5b61
SSDEEP

12288:0PVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEzhkmuVOkGnC6XAaunP5Gt2:oV2jUeQRI5wPN/+kmZDBwaux

Score

10^/10

icedid 742081363 banker loader macro trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

kinizamail-doc-09.26.22.docm

Resource

win7-20220812-en

icedid 742081363 banker trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

kinizamail-doc-09.26.22.docm

Resource

win10v2004-20220812-en

icedid 742081363 banker loader trojan

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Extracted

Family

icedid

Campaign

742081363

Extracted

Family

icedid

Campaign

742081363

C2

scainznorka.com

Targets

- Target
  
  kinizamail-doc-09.26.22.doc
- Size
  
  867KB
- MD5
  
  127a837bbe912f144fd3c98148308459
- SHA1
  
  06d87666a996908807e373a9a7569f24cf6c2e17
- SHA256
  
  0b1b3f889461485e71868160f46aeb008d8dd68c44b7b2e2f6f2c3e8831aae8b
- SHA512
  
  0cf93803d016f5694e2d428845bdfb582538a91b0d61e17883283f8a982384c6ab30e72fac6aad7cd5d60e26bc96dc24754b140127c1768bd532f8a7d57e5b61
- SSDEEP
  
  12288:0PVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEzhkmuVOkGnC6XAaunP5Gt2:oV2jUeQRI5wPN/+kmZDBwaux
Score

10^/10

icedid 742081363 banker trojan loader
- IcedID, BokBot
  IcedID is a banking trojan capable of stealing credentials.
  trojan banker icedid
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

icedid742081363bankertrojan

behavioral2

icedid742081363bankerloadertrojan

© 2018-2024

Terms | Privacy