Overview

overview

10

Static

static

ZoomInstallerFull.exe

windows7-x64

3

ZoomInstallerFull.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FakeZoom.zip

  • Size

    74.3MB

  • Sample

    221213-r9n16aeh59

  • MD5

    f9db6579e97e10c36fc383c13e8a0888

  • SHA1

    a7cfd88baa36910a8e9bfcfa7691ddf89c228094

  • SHA256

    d2d16d73e2b49a354353ffef34cb77a09d3ab66f4439bd7782e7982e03bb7481

  • SHA512

    ae15d263a6c0cb9fe5e529170a1adc07884326f686bd0656417e5cc27939b9ced2991bb640f53f868558a01cd2d626f7170ed137edace7348572080384948240

  • SSDEEP

    1572864:1So3dnuqrt1whjs8aj4Yw/i+Jbr5K5QNqSs6+ziRXKh:JBjr8hg8aspJQQQ4+ziRk

Score
10/10
icedid1441853872bankerloaderpersistencetrojan

Malware Config

Extracted

Family

icedid

Campaign

1441853872

C2

ewgahskoot.com

Targets

    • Target

      ZoomInstallerFull.exe

    • Size

      75.4MB

    • MD5

      3d36e5c4caa98515b4cbede14c253676

    • SHA1

      d2e1bd8ee0a2185557e5c01883cdccb53772f7bb

    • SHA256

      c15c7e69d90fd076c43a89bb11cf2a642bf3e354566aeecfb9b58fee4e27372a

    • SHA512

      b234812ba40bfee5dfacacf4d2198949d3636449e34a9f75c062d2bc20c6225edb1c4d25f737c5ecc0d31b1cbbf2960e3ba8ce97f006368871dda2a5cd2e6182

    • SSDEEP

      1572864:upDrQefrQSB+gTC4GB3RA9MLhWG7VYlSGTbANByfGajuTgIrPJGs:cDLfrQQ/FA3RAicfUjByfFIDJ

    Score
    10/10
    icedid1441853872bankerloaderpersistencetrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks