Overview

overview

10

Static

static

8

jaramillo,...2.docm

windows7-x64

10

jaramillo,...2.docm

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    jaramillo,file,12.23.2022.docm

  • Size

    1.3MB

  • Sample

    221224-wlv7saad28

  • MD5

    08a2ebd8fbbfd82744696f5b94df0f8b

  • SHA1

    2101ba42a90d76bae2d1e4a6b5bea49fae714e13

  • SHA256

    4852643fe93b40df2474b42cd3e5d66f96103f10b7bdc742d9d31691803861d6

  • SHA512

    7ecbce39a98265c8e3afb6649ea50fe6d6c6ee5069d1ddc182b2906ebfd81acfe5227fb14d958aea018f7fa265694fed56003eac134a7074b1b9045b90b85823

  • SSDEEP

    24576:/vpJmLOgHWi8bj11H2w5inpF7sONo/qiy7L9pvRDEG7EzqHm+Bmch:/vpJmgf3zliFpp3KqG+B

Score
10/10
icedid1212497363bankerloadermacrotrojan

Malware Config

Extracted

Family

icedid

Campaign

1212497363

Extracted

Family

icedid

Campaign

1212497363

C2

trbiriumpa.com

Targets

    • Target

      jaramillo,file,12.23.2022.docm

    • Size

      1.3MB

    • MD5

      08a2ebd8fbbfd82744696f5b94df0f8b

    • SHA1

      2101ba42a90d76bae2d1e4a6b5bea49fae714e13

    • SHA256

      4852643fe93b40df2474b42cd3e5d66f96103f10b7bdc742d9d31691803861d6

    • SHA512

      7ecbce39a98265c8e3afb6649ea50fe6d6c6ee5069d1ddc182b2906ebfd81acfe5227fb14d958aea018f7fa265694fed56003eac134a7074b1b9045b90b85823

    • SSDEEP

      24576:/vpJmLOgHWi8bj11H2w5inpF7sONo/qiy7L9pvRDEG7EzqHm+Bmch:/vpJmgf3zliFpp3KqG+B

    Score
    10/10
    icedid1212497363bankertrojanloader

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks