General
-
Target
2024-06-30_a5e533b76eaf9ba13d43b1ea6403a48c_bkransomware_icedid
-
Size
786KB
-
Sample
240630-vjcf8avamk
-
MD5
a5e533b76eaf9ba13d43b1ea6403a48c
-
SHA1
8d15333bc68755a56c77048b7cd1c82fd77c8667
-
SHA256
184ed3a1261abbb94e11431e3938f79fd8943841120ed608cbee98938e18667d
-
SHA512
12ad7d16b5463a7dc3b390b6cb58721c16a61d1e27c5e06fb36e20231b49d1d9bad0b9eae4a705bc4c6e82f81b977952653588941ecbcbbaf7ef500d681a95b3
-
SSDEEP
12288:+KQeX4+gJq5A6pe776wioj78+g4gOn27vQUQTnLUoN:JDhgr6M1jgLOXpjAQ
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-30_a5e533b76eaf9ba13d43b1ea6403a48c_bkransomware_icedid.exe
Resource
win7-20240508-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
2024-06-30_a5e533b76eaf9ba13d43b1ea6403a48c_bkransomware_icedid
-
Size
786KB
-
MD5
a5e533b76eaf9ba13d43b1ea6403a48c
-
SHA1
8d15333bc68755a56c77048b7cd1c82fd77c8667
-
SHA256
184ed3a1261abbb94e11431e3938f79fd8943841120ed608cbee98938e18667d
-
SHA512
12ad7d16b5463a7dc3b390b6cb58721c16a61d1e27c5e06fb36e20231b49d1d9bad0b9eae4a705bc4c6e82f81b977952653588941ecbcbbaf7ef500d681a95b3
-
SSDEEP
12288:+KQeX4+gJq5A6pe776wioj78+g4gOn27vQUQTnLUoN:JDhgr6M1jgLOXpjAQ
-
Modifies firewall policy service
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1