icedid | ae2a13c849149cc0f614e48476d56d18048d716fa2fba3fd1def3445ba4ef1f2 | Triage

Submit
Reports

Overview

overview

Static

static

8

mtrosecogi...6.docm

windows7-x64

mtrosecogi...6.docm

windows10-2004-x64

Sharing

General

Target

mtrosecogicfile09.26.doc
Size

866KB
Sample

220926-v8ac6acfcr
MD5

7d8eff6842d13c696056af3d6944701e
SHA1

4428435c1f81f451d2293b40a92a0cdae3563ed6
SHA256

ae2a13c849149cc0f614e48476d56d18048d716fa2fba3fd1def3445ba4ef1f2
SHA512

043621b8d997c369f853621cfe8b1b6b41c99f2f272a138a5757bb84f3216b49558070bfb992bc806ae7cd3a1896f5008c88ba0c186d1b1909d0a4a371091240
SSDEEP

12288:7qIkeVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DElFYjfHGlvYH9q6dYM:WIkeV2jUeQRI5wPN/MF0fHjH9qC

Score

10^/10

icedid 742081363 banker loader macro trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

mtrosecogicfile09.26.docm

Resource

win7-20220812-en

icedid 742081363 banker loader trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

mtrosecogicfile09.26.docm

Resource

win10v2004-20220812-en

icedid 742081363 banker loader trojan

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Extracted

Family

icedid

Campaign

742081363

C2

scainznorka.com

Targets

- Target
  
  mtrosecogicfile09.26.doc
- Size
  
  866KB
- MD5
  
  7d8eff6842d13c696056af3d6944701e
- SHA1
  
  4428435c1f81f451d2293b40a92a0cdae3563ed6
- SHA256
  
  ae2a13c849149cc0f614e48476d56d18048d716fa2fba3fd1def3445ba4ef1f2
- SHA512
  
  043621b8d997c369f853621cfe8b1b6b41c99f2f272a138a5757bb84f3216b49558070bfb992bc806ae7cd3a1896f5008c88ba0c186d1b1909d0a4a371091240
- SSDEEP
  
  12288:7qIkeVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DElFYjfHGlvYH9q6dYM:WIkeV2jUeQRI5wPN/MF0fHjH9qC
Score

10^/10

icedid 742081363 banker loader trojan
- IcedID, BokBot
  IcedID is a banking trojan capable of stealing credentials.
  trojan banker icedid
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

icedid742081363bankerloadertrojan

behavioral2

icedid742081363bankerloadertrojan

© 2018-2024

Terms | Privacy