Overview

overview

10

Static

static

8

kinizamail...2.docm

windows7-x64

10

kinizamail...2.docm

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    kinizamail.invoice.09.26.22.doc

  • Size

    866KB

  • Sample

    220926-wd1gjabef5

  • MD5

    f99a3ddefc11592f8e3a8afccd71cb3d

  • SHA1

    3033ca71a210cacd484deccef3dab32d054fe4a3

  • SHA256

    57d2ab6857597731cba0c9d624b35ae36eb5043b142ba3bd0867847daae6540b

  • SHA512

    fe2e9296f564eb6edc321828f633db3901b6dc396610c64fa1a9611e8c90d2bd5d279cb8b8d860eb0a1730f3e52caa727ba7175f2f6a6282b97422e1930c67d4

  • SSDEEP

    12288:ddVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEA6mu5GYdrljHHfzPY1T:ddV2jUeQRI5wPN/2mu5JrljHM

Score
10/10
icedid742081363bankerloadermacrotrojan

Malware Config

Extracted

Family

icedid

Campaign

742081363

Extracted

Family

icedid

Campaign

742081363

C2

scainznorka.com

Targets

    • Target

      kinizamail.invoice.09.26.22.doc

    • Size

      866KB

    • MD5

      f99a3ddefc11592f8e3a8afccd71cb3d

    • SHA1

      3033ca71a210cacd484deccef3dab32d054fe4a3

    • SHA256

      57d2ab6857597731cba0c9d624b35ae36eb5043b142ba3bd0867847daae6540b

    • SHA512

      fe2e9296f564eb6edc321828f633db3901b6dc396610c64fa1a9611e8c90d2bd5d279cb8b8d860eb0a1730f3e52caa727ba7175f2f6a6282b97422e1930c67d4

    • SSDEEP

      12288:ddVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEA6mu5GYdrljHHfzPY1T:ddV2jUeQRI5wPN/2mu5JrljHM

    Score
    10/10
    icedid742081363bankertrojanloader

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks