Overview

overview

10

Static

static

8

challenge-...64.dll

windows7-x64

10

challenge-...64.dll

windows10-2004-x64

10

challenge-...st.hta

windows7-x64

1

challenge-...st.hta

windows10-2004-x64

5

challenge-...st.dll

windows7-x64

10

challenge-...st.dll

windows10-2004-x64

10

challenge-...1.docm

windows7-x64

10

challenge-...1.docm

windows10-2004-x64

10

challenge-...c.pcap

windows7-x64

3

challenge-...c.pcap

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    challenge-files.zip

  • Size

    4.8MB

  • Sample

    221003-257mtabefq

  • MD5

    4edf33b3a4dd1c1c005aefeaa29c7f1d

  • SHA1

    e4d4bb8c8dcf357b068019660fdc72e65f577857

  • SHA256

    d312c079c51f2bf011902df86e1ca4cac84eb7c74ff104fa48a505caa88ef2fe

  • SHA512

    b647d071e71ece4a4d5d4601f28cbcab9f12a85014f1d06cc80ed65f35c7d3f81fc0b27cfd0855b456194f50e7f5dd2ce9588077735c2ec7f43f4a1e38ee2803

  • SSDEEP

    98304:DfFixex8es3YZIbSNMDHMDhODrxaQe8vNzLB/RensEGdCW/1BTK4EBzaQyLzZ:sAx8eOHawsDhk0QlvNLB/0nsEGdCWNIu

Score
10/10
icedid987543880548569227bankercore_loaderloadermacrotrojan

Malware Config

Extracted

Family

icedid

Botnet

987543880

C2

fimlubindu.top

vindurualeg.top

bigcostarikas.top

extrimefigim.top
Attributes
  • auth_var

    6

  • url_path

    /news/

Extracted

Family

icedid

Campaign

548569227

C2

supplementik.top

Targets

    • Target

      challenge-files/challenge-files/Tetoomdu64.dll

    • Size

      396KB

    • MD5

      6ed61b28923f1894663174a13a9a789f

    • SHA1

      787447b91095e8bb4f696a69c4b7cbaaf302e8c1

    • SHA256

      3ed5d0476d1ce4fd325666072983d295609fe94c5b65d5db47a53f462ac7a4dc

    • SHA512

      5d800fcb3ba63087d55992d9becd5db3a74ad18f75a84f2cae12faae50eb895f0482a6b3b069ddbc31033ee4f88279e4e33339a9058dac9425b628f1015c5ac7

    • SSDEEP

      6144:xe+1VoOnuR9/G8z+TxcIPpypXSmn4UohdE1xH+f:xROMu68giIP0imXonE3

    Score
    10/10
    icedid987543880bankercore_loadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid
    behavioral1behavioral2

    • Target

      challenge-files/challenge-files/collectionBoxConst.hta

    • Size

      3KB

    • MD5

      99a1a4391c6be3ac5f137c0a092d8edd

    • SHA1

      34afc663a569d0ba183c73ab40ae8d682273d193

    • SHA256

      b25865183c5cd2c5e550aca8476e592b62ed3e37e6b628f955bbed454fdbb100

    • SHA512

      45e5b38d72add4d28234b539071a3cb4059c9c104b5389a43190fd3197843e103fdaf7552c1edcb9bbbabe15b122a8bef0389ce39d6130b438a835c4c2d4f345

    Score
    5/10

    • Drops file in System32 directory

    behavioral3behavioral4

    • Target

      challenge-files/challenge-files/collectionBoxConst.jpg

    • Size

      538KB

    • MD5

      65641f6498b6f94b0bdeb886e448d460

    • SHA1

      b17591ec88cccf664f911f6e8a235e082e6bd892

    • SHA256

      51658887e46c88ed6d5861861a55c989d256a7962fb848fe833096ed6b049441

    • SHA512

      3896899d6c80de9dd383d15dde246a4478e94b72b7c780da9a3b4e2068aac85929b8665fbe8055ca9d1586c93fc1a7cc4dbdacf47cb3b3079d1830853ba9041c

    • SSDEEP

      6144:8DLTDShETtXZAngMPZQn41hGEn1qaM8nOD4E8ONTxyohggJXZrO:8PTDS6TvfImgBe8nO4oZG

    Score
    10/10
    icedid548569227bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid
    behavioral5behavioral6

    • Target

      challenge-files/challenge-files/docs 06.02.2021.doc

    • Size

      43KB

    • MD5

      f08771b9fdfe82caaa089641e2348c8e

    • SHA1

      b02c121597c9d56d7fab76b54834d5f3bd961e8c

    • SHA256

      cc721111b5924cfeb91440ecaccc60ecc30d10fffbdab262f7c0a17027f527d1

    • SHA512

      3bb2b582e7119c346473f78056f95e0890a3e74976de733739af9aaef810c4e62b35d7f81ec52acfbf675d3d501a048a36fa323ef76ee8843502424211b46ebd

    • SSDEEP

      768:u5WkgUEeFPIlj5oQ0fUDjxXSwU/+BtgKpyAAlQg6DPLFXS:plekVoQTCFmgKpslepC

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral7behavioral8

    • Target

      challenge-files/challenge-files/infection-traffic.pcap

    • Size

      3.9MB

    • MD5

      c7fcd889649eb0229620b2cc0fba5add

    • SHA1

      ab507bd070f99a3bce726176b37b1fb7d907d97c

    • SHA256

      14c26cf8ded22562b9d0f5d2923f20e27515dbedc25c97976889927d598ee262

    • SHA512

      a3ad9b15de43141d0fcf2cacceccdb70ed4b430330c769d630ccdf4780a936222c20a1ac6a94a6610a26b13a9d5421222ef2a9f751332146db569c72ab646016

    • SSDEEP

      49152:FHLP2dei6dBNQvmmnUOTJA/avOYTsGKHTDy8Fr6HHTWVdiiUoornjvO59P1lgREH:oI5alUEa/wOIsG0e8IHHpooVREJS7

    Score
    3/10
    behavioral9behavioral10

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks