icedid | 964d08c30e93f4f9783728ce6f35da2caf3dcacabc85bf39ab54e8e3f9083c53 | Triage

Submit
Reports

Overview

overview

Static

static

8

orionpitbi...2.docm

windows7-x64

orionpitbi...2.docm

windows10-2004-x64

Sharing

General

Target

orionpitbikesales.document.11.11.2022.doc
Size

1.3MB
Sample

221111-g92l5sbggq
MD5

aeb1778d4b96e3070355d39f2b08a46a
SHA1

4e1541914e151c4edc44b911d05350cf97b126af
SHA256

964d08c30e93f4f9783728ce6f35da2caf3dcacabc85bf39ab54e8e3f9083c53
SHA512

841a001c932802e35594e29411b1542197d572b7a617c93f4b6c2592d24ccb4ea75a2eb58d0c598effca4322df123f3acd9f867ce234db4a3a0cdacfbad3e0d0
SSDEEP

24576:1SM3HJByN63keT98TBa3qr6lzSAOCj3WxFVrCM84vAaD6cUru:PX7YGkeTWTBSqulzSA9erCMPYrru

Score

10^/10

icedid 1292139634 banker loader macro trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

orionpitbikesales.document.11.11.2022.docm

Resource

win7-20220901-en

icedid 1292139634 banker trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

orionpitbikesales.document.11.11.2022.docm

Resource

win10v2004-20220812-en

icedid 1292139634 banker loader trojan

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Extracted

Family

icedid

Campaign

1292139634

Extracted

Family

icedid

Campaign

1292139634

C2

oiurkastarting.com

Targets

- Target
  
  orionpitbikesales.document.11.11.2022.doc
- Size
  
  1.3MB
- MD5
  
  aeb1778d4b96e3070355d39f2b08a46a
- SHA1
  
  4e1541914e151c4edc44b911d05350cf97b126af
- SHA256
  
  964d08c30e93f4f9783728ce6f35da2caf3dcacabc85bf39ab54e8e3f9083c53
- SHA512
  
  841a001c932802e35594e29411b1542197d572b7a617c93f4b6c2592d24ccb4ea75a2eb58d0c598effca4322df123f3acd9f867ce234db4a3a0cdacfbad3e0d0
- SSDEEP
  
  24576:1SM3HJByN63keT98TBa3qr6lzSAOCj3WxFVrCM84vAaD6cUru:PX7YGkeTWTBSqulzSA9erCMPYrru
Score

10^/10

icedid 1292139634 banker trojan loader
- IcedID, BokBot
  IcedID is a banking trojan capable of stealing credentials.
  trojan banker icedid
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

icedid1292139634bankertrojan

behavioral2

icedid1292139634bankerloadertrojan

© 2018-2024

Terms | Privacy