icedid | c15c7e69d90fd076c43a89bb11cf2a642bf3e354566aeecfb9b58fee4e27372a | Triage

Sharing

General

Target

ZoomInstallerFull.exe
Size

75.4MB
Sample

221211-yafdasbh8y
MD5

3d36e5c4caa98515b4cbede14c253676
SHA1

d2e1bd8ee0a2185557e5c01883cdccb53772f7bb
SHA256

c15c7e69d90fd076c43a89bb11cf2a642bf3e354566aeecfb9b58fee4e27372a
SHA512

b234812ba40bfee5dfacacf4d2198949d3636449e34a9f75c062d2bc20c6225edb1c4d25f737c5ecc0d31b1cbbf2960e3ba8ce97f006368871dda2a5cd2e6182
SSDEEP

1572864:upDrQefrQSB+gTC4GB3RA9MLhWG7VYlSGTbANByfGajuTgIrPJGs:cDLfrQQ/FA3RAicfUjByfFIDJ

Score

10^/10

icedid 1441853872 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1441853872

C2

ewgahskoot.com

Targets

- Target
  
  ZoomInstallerFull.exe
- Size
  
  75.4MB
- MD5
  
  3d36e5c4caa98515b4cbede14c253676
- SHA1
  
  d2e1bd8ee0a2185557e5c01883cdccb53772f7bb
- SHA256
  
  c15c7e69d90fd076c43a89bb11cf2a642bf3e354566aeecfb9b58fee4e27372a
- SHA512
  
  b234812ba40bfee5dfacacf4d2198949d3636449e34a9f75c062d2bc20c6225edb1c4d25f737c5ecc0d31b1cbbf2960e3ba8ce97f006368871dda2a5cd2e6182
- SSDEEP
  
  1572864:upDrQefrQSB+gTC4GB3RA9MLhWG7VYlSGTbANByfGajuTgIrPJGs:cDLfrQQ/FA3RAicfUjByfFIDJ
Score

10^/10

icedid 1441853872 banker loader trojan
- IcedID, BokBot
  IcedID is a banking trojan capable of stealing credentials.
  trojan banker icedid
- Blocklisted process makes network request
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2

icedid1441853872bankerloadertrojan