Overview

overview

10

Static

static

8

mobileteld...2.docm

windows7-x64

10

mobileteld...2.docm

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    mobileteldoc09.26.2022.doc

  • Size

    866KB

  • Sample

    220927-caek4scce9

  • MD5

    84183482f75e753bd9ec0636bfa8d8f3

  • SHA1

    d7b130ad9978ee8596b2f240d7ad55364b3c51a1

  • SHA256

    b0fcc7aa39349b93b6913d5e8d08d6df8389e654740087fa5886d5c91d727010

  • SHA512

    ae5f217a83ca63fa74b31ac1b6b3db62efe4ef585a388b63763380dd7eb00110ea35f09b1a99bf82541f27b693ea3c9ad2990541a98c358d2e0c3032323e5160

  • SSDEEP

    12288:2VE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DExLuSzvC/PXSYqM6dW:2V2jUeQRI5wPN/wLxzwPXSYqMN

Score
10/10
icedid742081363bankerloadermacrotrojan

Malware Config

Extracted

Family

icedid

Campaign

742081363

Extracted

Family

icedid

Campaign

742081363

C2

scainznorka.com

Targets

    • Target

      mobileteldoc09.26.2022.doc

    • Size

      866KB

    • MD5

      84183482f75e753bd9ec0636bfa8d8f3

    • SHA1

      d7b130ad9978ee8596b2f240d7ad55364b3c51a1

    • SHA256

      b0fcc7aa39349b93b6913d5e8d08d6df8389e654740087fa5886d5c91d727010

    • SHA512

      ae5f217a83ca63fa74b31ac1b6b3db62efe4ef585a388b63763380dd7eb00110ea35f09b1a99bf82541f27b693ea3c9ad2990541a98c358d2e0c3032323e5160

    • SSDEEP

      12288:2VE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DExLuSzvC/PXSYqM6dW:2V2jUeQRI5wPN/wLxzwPXSYqMN

    Score
    10/10
    icedid742081363bankertrojanloader

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks