Overview

overview

10

Static

static

cattle/backplate.dll

windows7-x64

10

cattle/backplate.dll

windows10-2004-x64

10

cattle/celsius.cmd

windows7-x64

1

cattle/celsius.cmd

windows10-2004-x64

1

cattle/pigeons.cmd

windows7-x64

1

cattle/pigeons.cmd

windows10-2004-x64

1

personal_data.lnk

windows7-x64

10

personal_data.lnk

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Desktop.zip
  • Size 90KB
  • Sample221102-q573ssbhak
  • SHA256 e58db20886e6db592a980fb35a6b235d55beced5e984be0d066ab9802b463a14
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
icedid3479236560bankerloadertrojan

Malware Config

Extracted

Family

  • icedid

Campaign

  • 3479236560

C2

  • hardenpasedaken.com

Targets

    • Target
      cattle/backplate.dat
    • Size 52KB
    • SHA256 08f355f7dca50d30cd288735151a4e6d5dfb5bf2336be6e4f3b44ba881e4b721
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    icedid3479236560bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    behavioral1behavioral2
    • Target
      cattle/celsius.cmd
    • Size 253B
    • SHA256 dd48f48938f8b207ee776895ade78323d31850204f68a72aa5a74c78e0119cf3
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral3behavioral4
    • Target
      cattle/pigeons.cmd
    • Size 368B
    • SHA256 8dafc839fc563b0966e68f9530691d2ec38f808132fb28a1ff62ece2c1a17406
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral5behavioral6
    • Target
      personal_data.lnk
    • Size 1KB
    • SHA256 8b8b96f0eae35faff95622009e7c424d749e86129994ea61f437cc02264fa49b
    • MD5 SHA1 SHA512
    Score
    10/10
    icedid3479236560bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral7behavioral8

MITRE ATT&CK Enterprise v6

Tasks