Overview

overview

10

Static

static

3

Document_6...12.pdf

windows10-1703-x64

10

Document_6...12.pdf

windows10-2004-x64

10

Resubmissions

13-01-2023 03:19

230113-dt7lnsdh57 3

12-01-2023 20:51

230112-zncd8see5z 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Document_61_Unpaid_-1-12.pdf

  • Size

    108KB

  • Sample

    230112-zncd8see5z

  • MD5

    69fec563aa8bdfe9350f7c7534faec86

  • SHA1

    8a09a79aa30a497ca812111293f896ca88e8aa32

  • SHA256

    897941816861d957d6eacd2bcbb7b06fd48c9f73be02b72082a01a257c85f3f2

  • SHA512

    dde5428609730781e9a7e30e973af161e261863a1e1f99c657fac3ae393f472f018bbdf37d764ee66b1f03e4ba86995d23a91b622b71a8c76d73e15266dc9c5a

  • SSDEEP

    3072:x1F8+5dK2CVe3TlYaxd8DI07HkCqI+P5iX7El8:u6K2CUBYaxuDIuHkZoLEl8

Score
10/10
icedid1387823457bankerlinkloaderpdfpersistencetrojan

Malware Config

Extracted

Family

icedid

Campaign

1387823457

Extracted

Family

icedid

Campaign

1387823457

C2

allertmnemonkik.com

Targets

    • Target

      Document_61_Unpaid_-1-12.pdf

    • Size

      108KB

    • MD5

      69fec563aa8bdfe9350f7c7534faec86

    • SHA1

      8a09a79aa30a497ca812111293f896ca88e8aa32

    • SHA256

      897941816861d957d6eacd2bcbb7b06fd48c9f73be02b72082a01a257c85f3f2

    • SHA512

      dde5428609730781e9a7e30e973af161e261863a1e1f99c657fac3ae393f472f018bbdf37d764ee66b1f03e4ba86995d23a91b622b71a8c76d73e15266dc9c5a

    • SSDEEP

      3072:x1F8+5dK2CVe3TlYaxd8DI07HkCqI+P5iX7El8:u6K2CUBYaxuDIuHkZoLEl8

    Score
    10/10
    icedid1387823457bankertrojanloaderpersistence

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

4
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks