icedid | f4273d576c6c363c06646c8c39fb5090b51289e181203d09997244b673ef899f | Triage

Submit
Reports

Overview

overview

Static

static

8

localnet-d...6.docm

windows7-x64

localnet-d...6.docm

windows10-2004-x64

Sharing

General

Target

localnet-doc-09.26.doc
Size

867KB
Sample

220926-wde6lacfeq
MD5

621fd319c105b948a682c68bd86f970d
SHA1

1cb7b34338364a0a4468eeb4ed71cdbaebd1ae85
SHA256

f4273d576c6c363c06646c8c39fb5090b51289e181203d09997244b673ef899f
SHA512

b16e1dccbdf8f428b39c737e1654ba2f4f511f04d7fb581487d14f35b2dd8dbc1af0f2c7135a0388ddbc19c5bfd49a8d900aa94fab2b755128602af4ea86a364
SSDEEP

12288:mDmVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEyM/QuuV++HfzPA3:mDmV2jUeQRI5wPN/QQVV++Hc3

Score

10^/10

icedid 742081363 banker loader macro trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

localnet-doc-09.26.docm

Resource

win7-20220901-en

icedid 742081363 banker trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

localnet-doc-09.26.docm

Resource

win10v2004-20220901-en

icedid 742081363 banker loader trojan

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Extracted

Family

icedid

Campaign

742081363

Extracted

Family

icedid

Campaign

742081363

C2

scainznorka.com

Targets

- Target
  
  localnet-doc-09.26.doc
- Size
  
  867KB
- MD5
  
  621fd319c105b948a682c68bd86f970d
- SHA1
  
  1cb7b34338364a0a4468eeb4ed71cdbaebd1ae85
- SHA256
  
  f4273d576c6c363c06646c8c39fb5090b51289e181203d09997244b673ef899f
- SHA512
  
  b16e1dccbdf8f428b39c737e1654ba2f4f511f04d7fb581487d14f35b2dd8dbc1af0f2c7135a0388ddbc19c5bfd49a8d900aa94fab2b755128602af4ea86a364
- SSDEEP
  
  12288:mDmVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEyM/QuuV++HfzPA3:mDmV2jUeQRI5wPN/QQVV++Hc3
Score

10^/10

icedid 742081363 banker trojan loader
- IcedID, BokBot
  IcedID is a banking trojan capable of stealing credentials.
  trojan banker icedid
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

icedid742081363bankertrojan

behavioral2

icedid742081363bankerloadertrojan

© 2018-2024

Terms | Privacy