Resubmissions

01-12-2022 21:09

221201-zztsnaef7z 10

01-12-2022 21:03

221201-zwbgxaec9t 1

General

  • Target

    Document_37_Dec1.html

  • Size

    221KB

  • Sample

    221201-zztsnaef7z

  • MD5

    3be804323d8ab42ec08a0d4422610087

  • SHA1

    9ecd7fc9ac30ee972ef5437ba822d09c840205ee

  • SHA256

    b0523c2b7ac08e53ec8868e1c1e7575905a43ab3a3be92b259d299233b919291

  • SHA512

    5bcb5c6f1b4ee8bf75747285a7daa3102be6ce9c3587f88ea8e9fea3b2f68485813ca3c321e4730862cb3ad7cf02dd38f5eb8ca1c0ede31554930c00f54acc76

  • SSDEEP

    6144:Qih/ffNwPfOD9NuUNSem3N/DkSf3Yx1VJSxt+ooYuwps:PfNwXxYoAK3Yx3JSxcYZs

Malware Config

Extracted

Family

icedid

Campaign

2271535685

Targets

    • Target

      Document_37_Dec1.html

    • Size

      221KB

    • MD5

      3be804323d8ab42ec08a0d4422610087

    • SHA1

      9ecd7fc9ac30ee972ef5437ba822d09c840205ee

    • SHA256

      b0523c2b7ac08e53ec8868e1c1e7575905a43ab3a3be92b259d299233b919291

    • SHA512

      5bcb5c6f1b4ee8bf75747285a7daa3102be6ce9c3587f88ea8e9fea3b2f68485813ca3c321e4730862cb3ad7cf02dd38f5eb8ca1c0ede31554930c00f54acc76

    • SSDEEP

      6144:Qih/ffNwPfOD9NuUNSem3N/DkSf3Yx1VJSxt+ooYuwps:PfNwXxYoAK3Yx3JSxcYZs

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Tasks