Overview

overview

10

Static

static

8

herts.uk.d...2.docm

windows7-x64

10

herts.uk.d...2.docm

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    herts.uk.document.12.23.2022.docm

  • Size

    1.3MB

  • Sample

    221224-wlx2daad36

  • MD5

    8c8f206c903ee4b4561592a473d7a13e

  • SHA1

    f6522e0d59c81c19076ca634eb892c4aca33d992

  • SHA256

    a074a4b714a0db7d33a60eef8796605efcb2b41c109370231dc8b972bb6c45fe

  • SHA512

    f340da930c0f923480ee832a0c060fb499095a4a0e39620e11846cdf7fd953772190779393b763a1a48fa8187815bd5d19885151e60e05cc7948fe277583feb3

  • SSDEEP

    24576:/qpJmLOgHWi8bj11H2w5inpF7sONo/qiy7L9pvRDYG7EzqHm+Bmcn:/qpJmgf3zliFppTKqG+H

Score
10/10
icedid1212497363bankerloadermacrotrojan

Malware Config

Extracted

Family

icedid

Campaign

1212497363

Extracted

Family

icedid

Campaign

1212497363

C2

trbiriumpa.com

Targets

    • Target

      herts.uk.document.12.23.2022.docm

    • Size

      1.3MB

    • MD5

      8c8f206c903ee4b4561592a473d7a13e

    • SHA1

      f6522e0d59c81c19076ca634eb892c4aca33d992

    • SHA256

      a074a4b714a0db7d33a60eef8796605efcb2b41c109370231dc8b972bb6c45fe

    • SHA512

      f340da930c0f923480ee832a0c060fb499095a4a0e39620e11846cdf7fd953772190779393b763a1a48fa8187815bd5d19885151e60e05cc7948fe277583feb3

    • SSDEEP

      24576:/qpJmLOgHWi8bj11H2w5inpF7sONo/qiy7L9pvRDYG7EzqHm+Bmcn:/qpJmgf3zliFppTKqG+H

    Score
    10/10
    icedid1212497363bankertrojanloader

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks