icedid | e269a681bba217da4d23d53a8cb44c19d502af3a25b37c416e0d5f273caf589e | Triage

Submit
Reports

Overview

overview

Static

static

8

lightlink-...6.docm

windows7-x64

lightlink-...6.docm

windows10-2004-x64

Sharing

General

Target

lightlink-doc-09.26.doc
Size

867KB
Sample

220926-v8ac6acfdm
MD5

55656aac9077222bfb6c1f9329430a62
SHA1

b437d4442846fb0605eccfe55644c715dd4ace4c
SHA256

e269a681bba217da4d23d53a8cb44c19d502af3a25b37c416e0d5f273caf589e
SHA512

c94ab979d7e2ecdee43bc9edf4117c904c538c612cbf88dfdfb5dcff3d25b2c88b7966145353b18d50b889fe4e2ce19385d03950a361db2da92f7ac281b915ac
SSDEEP

12288:XevVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEuXmu5GYAH7og1ANO:OvV2jUeQRI5wPN/hmu5iEQ

Score

10^/10

icedid 742081363 banker loader macro trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

lightlink-doc-09.26.docm

Resource

win7-20220812-en

icedid 742081363 banker loader trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

lightlink-doc-09.26.docm

Resource

win10v2004-20220901-en

icedid 742081363 banker loader trojan

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Extracted

Family

icedid

Campaign

742081363

C2

scainznorka.com

Targets

- Target
  
  lightlink-doc-09.26.doc
- Size
  
  867KB
- MD5
  
  55656aac9077222bfb6c1f9329430a62
- SHA1
  
  b437d4442846fb0605eccfe55644c715dd4ace4c
- SHA256
  
  e269a681bba217da4d23d53a8cb44c19d502af3a25b37c416e0d5f273caf589e
- SHA512
  
  c94ab979d7e2ecdee43bc9edf4117c904c538c612cbf88dfdfb5dcff3d25b2c88b7966145353b18d50b889fe4e2ce19385d03950a361db2da92f7ac281b915ac
- SSDEEP
  
  12288:XevVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEuXmu5GYAH7og1ANO:OvV2jUeQRI5wPN/hmu5iEQ
Score

10^/10

icedid 742081363 banker loader trojan
- IcedID, BokBot
  IcedID is a banking trojan capable of stealing credentials.
  trojan banker icedid
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

icedid742081363bankerloadertrojan

behavioral2

icedid742081363bankerloadertrojan

© 2018-2024

Terms | Privacy