Overview

overview

10

Static

static

Invoice-09...re.bat

windows10-2004-x64

1

Invoice-09...ng.dll

windows10-2004-x64

10

Invoice-09...ts.lnk

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PW_Invoice-09-27-document-352_ISO.zip

  • Size

    136KB

  • Sample

    220927-tbhslaehfl

  • MD5

    c279bf24b2f2a334a56f5a4c5accb708

  • SHA1

    7d442074b9cb848ec926dd1dcca9e0e62aac2008

  • SHA256

    5361245f19393d0f726dc8dc55c68eecbb609207969ccff718ed52f7bed3b03b

  • SHA512

    e3319d8299a4cb60c14e4c8fc3ec613a49fb6a189388e5ccba8f05752c730c88ce206e8fcfe77cfce641c538358e8cb04d02124c861f4c01967465248db163e0

  • SSDEEP

    3072:v2tpKNFnz5UVJT56eYLhB2vfg7djGIJJvQlji4ZaclanU20XAX78:v2Tih5UEeqMv47djlPUm4Zac8nUwX78

Score
10/10
icedid973312338bankerloadertrojan

Malware Config

Extracted

Family

icedid

Campaign

973312338

C2

tezycronam.com

Targets

    • Target

      Invoice-09-27-document-352_ISO/bad/texture.bat

    • Size

      1KB

    • MD5

      0ab5394460b5ec33a039937273245d3a

    • SHA1

      b86ddc2281c980057676d6eb4f993348281c116d

    • SHA256

      39c5959f6a776552af39caa285a122726c4dac11e336eba3c1e92cd66f75ad06

    • SHA512

      36ef7e5add84665652ef2a4261a29017b676899de63d589126390901b2e8b1022358fe04e84f26462bbb91d0292f39eba1ad499b05a435c3f3f443727e72c538

    Score
    1/10
    behavioral1

    • Target

      Invoice-09-27-document-352_ISO/bad/unpromising.dat

    • Size

      476KB

    • MD5

      77c5c18a9a131755198f532b2cea339f

    • SHA1

      05720f2649c1fe5b6b5f7a7675159c227a13d482

    • SHA256

      02347fb46156e8f43f223791ee37944c1cfc3ed729a97316ec2922308b577a57

    • SHA512

      2b24edf809a421ca2ffe7e6063ab10b7c47ee7a8c4be9fd23221f60db5b64f4ab2e9dc789be12aef3f1cec5d77cbfe7dc34d5e3222a16ce29b4c53eba14f2561

    • SSDEEP

      6144:PaOfpYZEFRrz9QeQAi2q7pDTyq1i6qQUevvtl1r5EYQ:BpWyRNiJ7pnyq1i6qzevxr5EYQ

    Score
    10/10
    icedid973312338bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    behavioral2

    • Target

      Invoice-09-27-document-352_ISO/documents.lnk

    • Size

      1KB

    • MD5

      806219b3d0c770dce2830e9bde7ae6fc

    • SHA1

      5e11cf869bf9f1f42afe0eef91a8e83cf7e65e38

    • SHA256

      78b25495e16cb3465b67ac8fc149b71683f11140be9cf4679cafc2eda5bc0a09

    • SHA512

      2d52f36f399d450a3d0635e35e41cfc6678106a4e61e109fb1360bfe30ceec7e31e7388ae03cdbc5c8a4672533ffb376e13a1c969a144af3507fdea6178e6e1e

    Score
    3/10
    behavioral3

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks