icedid | de81ef356acc2e199252f8fe2a894c36c6e327d5efd3abaaa7df477f3942e33b

General

Target
clock_in.msi
Size 720KB
Sample221205-x4ehesha68
SHA256 de81ef356acc2e199252f8fe2a894c36c6e327d5efd3abaaa7df477f3942e33b
MD5 67d8f0f4203f74c7dc9c3ea8a00ab6b8
SHA1 ca6fd6caed882f183bc25963c4ea7f11923d7680
SHA512 3b71d35bd608d6f1b970faeb641b9347dd48f686295b18ffac96f121c227c203527892ef298705687a9084bd2aca2171b23d52316c337891a63ef00e85c1b366
SSDEEP 12288:QwHL0D7lkCPumy9chfA+tl8B0igC+/NHBh1SMHs:lHL01/zyt+b8BtZKBzSE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

icedid

Campaign

787509923

C2

kamintrewftor.com

Targets

- Target
  clock_in.msi
- Size 720KB
- SHA256 de81ef356acc2e199252f8fe2a894c36c6e327d5efd3abaaa7df477f3942e33b
- MD5 67d8f0f4203f74c7dc9c3ea8a00ab6b8
- SHA1 ca6fd6caed882f183bc25963c4ea7f11923d7680
- SHA512 3b71d35bd608d6f1b970faeb641b9347dd48f686295b18ffac96f121c227c203527892ef298705687a9084bd2aca2171b23d52316c337891a63ef00e85c1b366
- SSDEEP 12288:QwHL0D7lkCPumy9chfA+tl8B0igC+/NHBh1SMHs:lHL01/zyt+b8BtZKBzSE
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

icedid 787509923 banker loader trojan
- IcedID, BokBot
  IcedID is a banking trojan capable of stealing credentials.
  trojan banker icedid
- Blocklisted process makes network request
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

IcedID, BokBot

Blocklisted process makes network request

Loads dropped DLL

Enumerates connected drives

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2