Overview

overview

10

Static

static

document-1...93.iso

windows7-x64

3

document-1...93.iso

windows10-2004-x64

3

pss10r.chm

windows7-x64

3

pss10r.chm

windows10-2004-x64

1

run.cmd

windows7-x64

8

run.cmd

windows10-2004-x64

8

ver123.dll

windows7-x64

10

ver123.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    redacted-doc-11.14.22.zip
  • Size 458KB
  • Sample221114-xg9eaada24
  • SHA256 0306e59d0b52279dc773e1cb8cba8203cc39023af0f34bae33c1eda484beeb0b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
icedid1609463178bankerloadertrojan

Malware Config

Extracted

Family

  • icedid

Campaign

  • 1609463178

C2

  • trolspeaksunt.com

Targets

    • Target
      document-130722.18093.iso
    • Size 856KB
    • SHA256 979502e5c1d4c7eb4c771bcaa61504c225d2a06bd40e953e32b0e1e60953585f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral1behavioral2
    • Target
      pss10r.chm
    • Size 392KB
    • SHA256 e6c58b329804c30442be8159296b54b612c32b038d826d7e2cb058042d9aa852
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral3behavioral4
    • Target
      run.cmd
    • Size 159B
    • SHA256 f96ca4d15febe51758689d9c93c5ff06449a67aacc9b619c249dd00f7b65d179
    • MD5 SHA1 SHA512
    Score
    8/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral5behavioral6
    • Target
      ver123.dll
    • Size 96KB
    • SHA256 45704a092e0f331dec2c86dc2f7259b4680bb71c542aea59005bf1b1a8a18d3f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    icedid1609463178bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    behavioral7behavioral8

MITRE ATT&CK Enterprise v6

Tasks