Overview

overview

10

Static

static

$RTKOW1B.zip

windows7-x64

1

$RTKOW1B.zip

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    $RTKOW1B.zip

  • Size

    827KB

  • Sample

    221220-x965madh9w

  • MD5

    bd1619082ee07b21fa40d532ef9cb8e4

  • SHA1

    443713056deb34363bed0e165099412d23d4269d

  • SHA256

    aeaec6ca7cfc629df46779db6f5b92da8a532bd3baf21570ea76e9f9f5becd40

  • SHA512

    a19aa3cc69af6e83722bc79d5baa72336ed1bbb1c8297e2b4b068a95f31e51f1d5dde67e6cceebf0d0b4265866a0bd918db6f0f3b024f07383ac13721a6bd207

  • SSDEEP

    24576:KoqpFTwvyQNR53uFPnTsuLJR6LJsDzpDO4lc0:KppFANnu9QmJR6LYK4lc0

Score
10/10
icedid3114391984bankerloadertrojan

Malware Config

Extracted

Family

icedid

Campaign

3114391984

C2

estrabornhot.com

Targets

    • Target

      $RTKOW1B.zip

    • Size

      827KB

    • MD5

      bd1619082ee07b21fa40d532ef9cb8e4

    • SHA1

      443713056deb34363bed0e165099412d23d4269d

    • SHA256

      aeaec6ca7cfc629df46779db6f5b92da8a532bd3baf21570ea76e9f9f5becd40

    • SHA512

      a19aa3cc69af6e83722bc79d5baa72336ed1bbb1c8297e2b4b068a95f31e51f1d5dde67e6cceebf0d0b4265866a0bd918db6f0f3b024f07383ac13721a6bd207

    • SSDEEP

      24576:KoqpFTwvyQNR53uFPnTsuLJR6LJsDzpDO4lc0:KppFANnu9QmJR6LYK4lc0

    Score
    10/10
    icedid3114391984bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks