icedid | 722018f7c9ae47ffa1e6372e8134b35cd1598cfc40935172222beb56d7ebefff | Triage

Resubmissions

12-12-2022 15:33

221212-szalfsbg25 10

12-12-2022 15:30

221212-sxkcwaed8w 3

Sharing

General

Target

IRS_Form-12-09#190.iso
Size

1.8MB
Sample

221212-szalfsbg25
MD5

6c9e3fb476ed918865649c003308b614
SHA1

6eff37754b16fec4da00742aca1e68f286c9a7c4
SHA256

722018f7c9ae47ffa1e6372e8134b35cd1598cfc40935172222beb56d7ebefff
SHA512

2f31aa660b7217619405503a48a5ef84fdcf746cde8bc15d5230b2294c0eaaa40cdc5df8e743fcecb30214c2c537a8cc913623405e02e6df56e4540a34d77b2c
SSDEEP

24576:g0zID/kJAHL/WPXoPcTPbgrQlRNKIg8g:g0u/WPXoPcTPbgrQlRNKIg8g

Score

10^/10

icedid 1268412609 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1268412609

C2

ewgahskoot.com

Targets

- Target
  
  IRS_Form-12-09#190.iso
- Size
  
  1.8MB
- MD5
  
  6c9e3fb476ed918865649c003308b614
- SHA1
  
  6eff37754b16fec4da00742aca1e68f286c9a7c4
- SHA256
  
  722018f7c9ae47ffa1e6372e8134b35cd1598cfc40935172222beb56d7ebefff
- SHA512
  
  2f31aa660b7217619405503a48a5ef84fdcf746cde8bc15d5230b2294c0eaaa40cdc5df8e743fcecb30214c2c537a8cc913623405e02e6df56e4540a34d77b2c
- SSDEEP
  
  24576:g0zID/kJAHL/WPXoPcTPbgrQlRNKIg8g:g0u/WPXoPcTPbgrQlRNKIg8g
Score

10^/10

icedid 1268412609 banker loader trojan
- IcedID, BokBot
  IcedID is a banking trojan capable of stealing credentials.
  trojan banker icedid
- Blocklisted process makes network request
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2

icedid1268412609bankerloadertrojan