Overview

overview

10

Static

static

8

meaccounti...2.docm

windows7-x64

10

meaccounti...2.docm

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    meaccountingdoc09.26.2022.doc

  • Size

    867KB

  • Sample

    220926-v8ac6acfdk

  • MD5

    4b06f43a6ea373c819427a22e0ce3c61

  • SHA1

    4271539484964bb36011eff1f6a29440e05ade95

  • SHA256

    9ec7d14c58d34a094e55bfe20b7dc40c9391d53de9b7c0b6aac2fc7518748330

  • SHA512

    30df44639f80c8347d0748dd14ca99315738572777fcfc2e59fe13f61f829d3798713953322d41c28a3a1bd3fff3ec51928e6dbb84f3818889a9775072f5f362

  • SSDEEP

    12288:YVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DE5Orlj0HfzPnunP5Gur:YV2jUeQRI5wPN/EOrloHLuV

Score
10/10
icedid742081363bankerloadermacrotrojan

Malware Config

Extracted

Family

icedid

Campaign

742081363

Extracted

Family

icedid

Campaign

742081363

C2

scainznorka.com

Targets

    • Target

      meaccountingdoc09.26.2022.doc

    • Size

      867KB

    • MD5

      4b06f43a6ea373c819427a22e0ce3c61

    • SHA1

      4271539484964bb36011eff1f6a29440e05ade95

    • SHA256

      9ec7d14c58d34a094e55bfe20b7dc40c9391d53de9b7c0b6aac2fc7518748330

    • SHA512

      30df44639f80c8347d0748dd14ca99315738572777fcfc2e59fe13f61f829d3798713953322d41c28a3a1bd3fff3ec51928e6dbb84f3818889a9775072f5f362

    • SSDEEP

      12288:YVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DE5Orlj0HfzPnunP5Gur:YV2jUeQRI5wPN/EOrloHLuV

    Score
    10/10
    icedid742081363bankertrojanloader

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks