Overview

overview

10

Static

static

list_of_do...d6.iso

windows7-x64

3

list_of_do...d6.iso

windows10-2004-x64

3

6020f377-5...86.dll

windows7-x64

10

6020f377-5...86.dll

windows10-2004-x64

10

list_of_do...d6.lnk

windows7-x64

10

list_of_do...d6.lnk

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    list_of_documents-7e684a9a-3359-4c66-9785-873690ca67d6.iso
  • Size 2.0MB
  • Sample221007-vghkfschf5
  • SHA256 b547ee0dede71e0d7bea41fc113f840224aa018e157c18e61c6e9303b036714c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
icedid3400778916bankerloadertrojan

Malware Config

Extracted

Family

  • icedid

Campaign

  • 3400778916

C2

  • sincaplox.com

Targets

    • Target
      list_of_documents-7e684a9a-3359-4c66-9785-873690ca67d6.iso
    • Size 2.0MB
    • SHA256 b547ee0dede71e0d7bea41fc113f840224aa018e157c18e61c6e9303b036714c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral1behavioral2
    • Target
      6020f377-5f14-421e-91a0-9721b7ad4286.kCU
    • Size 728KB
    • SHA256 5fca529ae6141f004b14b4894ec12b1d138247096d2149ef64c6488fdee23bf5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    icedid3400778916bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    behavioral3behavioral4
    • Target
      list_of_documents-7e684a9a-3359-4c66-9785-873690ca67d6.lnk
    • Size 1KB
    • SHA256 363b9d9cf6db9fad8fe3799c9d44962e9f5efb4c34d55f4f230a0c55990ecc31
    • MD5 SHA1 SHA512
    Score
    10/10
    icedid3400778916bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks