icedid | a4843e1bfd7169fd3ff3207a39603ad4308dedb39dbf25a168cab916515f5104 | Triage

Sharing

General

Target

Request-09-27-document-235.iso
Size

1.9MB
Sample

220929-vm4pwabed5
MD5

c7f65fb3d817ac077f6c75c852caeb05
SHA1

3632792b1e1643402fc88e76ed2c1734cc2b4d86
SHA256

a4843e1bfd7169fd3ff3207a39603ad4308dedb39dbf25a168cab916515f5104
SHA512

d700144a63d491ddf33d5419e2b1a321abc34264de80d3e5f0e5982fe25d39637bf4f2f63d463b30dedb2128550de5b525f1753113ea5d9498bd36f36378523b
SSDEEP

6144:JEF/cCDQ2eyT3Zw+p0Yyvq1i6qz/QeQqHDT4xE:IcmQ2es3Zw+pRcq1i6qhjS

Score

10^/10

icedid 973312338 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

973312338

C2

tezycronam.com

Targets

- Target
  
  Request-09-27-document-235.iso
- Size
  
  1.9MB
- MD5
  
  c7f65fb3d817ac077f6c75c852caeb05
- SHA1
  
  3632792b1e1643402fc88e76ed2c1734cc2b4d86
- SHA256
  
  a4843e1bfd7169fd3ff3207a39603ad4308dedb39dbf25a168cab916515f5104
- SHA512
  
  d700144a63d491ddf33d5419e2b1a321abc34264de80d3e5f0e5982fe25d39637bf4f2f63d463b30dedb2128550de5b525f1753113ea5d9498bd36f36378523b
- SSDEEP
  
  6144:JEF/cCDQ2eyT3Zw+p0Yyvq1i6qz/QeQqHDT4xE:IcmQ2es3Zw+pRcq1i6qhjS
Score

10^/10

icedid 973312338 banker loader trojan
- IcedID, BokBot
  IcedID is a banking trojan capable of stealing credentials.
  trojan banker icedid
- Blocklisted process makes network request
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

icedid973312338bankerloadertrojan