Overview

overview

10

Static

static

Setup_Win_...20.iso

windows10-1703-x64

10

Setup_Win_...20.iso

windows7-x64

3

Setup_Win_...20.iso

windows10-2004-x64

3

Resubmissions

16-01-2023 23:09

230116-25grdsfa69 10

16-01-2023 23:07

230116-24eweafa63 1

16-01-2023 22:17

230116-17bgqaac6y 3

16-01-2023 20:05

230116-yt4j8scf85 6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Setup_Win_16-01-2023_20-01-20.zip

  • Size

    143KB

  • Sample

    230116-25grdsfa69

  • MD5

    73797f6af543c3330118954862166add

  • SHA1

    1e5c8484f6bfd3c7bfeb1e571221274187b6219d

  • SHA256

    088afa7604b91e332578005c00db7b3135f2dcd2ac71c4336d135d61a542730d

  • SHA512

    6621bce9d92d648b93bdc5800fb42fcb6f2949bbff6977acd1ca35f2582a033360d4b745b8db9197ca056a3b3d32e038cea5d5c77e63f3eec56dbe68ddf75b96

  • SSDEEP

    3072:6Yt2mbH7oqc86W14uPisjemC8vMgUUgFEI3ojYZFqOh4JCGjyJcrO:5gqc86W14MemFEgXzI48ZsOahjygO

Score
10/10
icedid3147800127bankerloadertrojan

Malware Config

Extracted

Family

icedid

Campaign

3147800127

C2

dgormiugatox.com

Targets

    • Target

      Setup_Win_16-01-2023_20-01-20.iso

    • Size

      1.4MB

    • MD5

      be28a0c85db66e8d7eb934ad11cca6c3

    • SHA1

      7478ebcfcfd71fdfb47b868a23e2e0a951d5e6b1

    • SHA256

      0a5a7570e85cbfc0b573150ffb03ad1fdeb9b7d0235cfd3af952fff29ccbcbb1

    • SHA512

      c28aa7d606eac59a9985192def15d58dcb1138b823d63330b5fdc7e758cf1ab097a342378d88ae754a6a058beab523fdbcd292e7f56096dd691a49eca6441716

    • SSDEEP

      6144:Gb6sbYTf1IFpSQjAfK67TbDkJGvPiaTB00CSz:HNf60h0JGSaTn

    Score
    10/10
    icedid3147800127bankerloadertrojan

    • IcedID, BokBot

      IcedID is a banking trojan capable of stealing credentials.

      trojanbankericedid

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks