MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03aa3045bab94987cc94998a560af28274294d2a1c913b7b04a420acd5a4417b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 03aa3045bab94987cc94998a560af28274294d2a1c913b7b04a420acd5a4417b
SHA3-384 hash: 47c6964ef8c2b68f528f10299a371384a0383c2c16da44a24690bbc0745d322eac13aa110562f741ef21a04f60b839bd
SHA1 hash: 8fe6afbc8e74ca9b4740c751265d9111cc2cc0c0
MD5 hash: 64d0164d852e5a48714d088918e896fd
humanhash: bakerloo-island-winter-island
File name:details-1095979.doc
Download: download sample
Signature IcedID
Create hunting rule
File size:79'744 bytes
First seen:2020-07-16 06:54:20 UTC
Last seen:Never
File type:Word file doc
MIME type:application/vnd.openxmlformats-officedocument.wordprocessingml.document
ssdeep 1536:Sg72BrTS1201vYbJkUmLYtKJknEW5OYue0pUtlnW6z7vrkjg9/:SQkI2012JkUGwKUf5Me0p8nzn/
TLSH 9873490B9D1C4993E57886BC7C135FACBE083E1CAC862AFF01625ED6BE711524E5E14B
Reporter abuse_ch
Tags:doc IcedID


Avatar
abuse_ch
IcedID payload URL:
http://www.haeunkim.com/5626.exe

IcedID C2:
https://ldrmars.casa

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/389357
Signature
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Document contains an embedded macro with GUI obfuscation
Document contains an embedded VBA macro which may execute processes
Document contains an embedded VBA macro with suspicious strings
Document exploit detected (creates forbidden files)
Document exploit detected (process start blacklist hit)
Machine Learning detection for sample
Microsoft Office drops suspicious files
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potential malicious VBS script found (suspicious strings)
Powershell drops PE file
Sigma detected: Microsoft Office Product Spawning Windows Shell
Suspicious powershell command line found
Tries to download and execute files (via powershell)
Wscript starts Powershell (via cmd or directly)
Yara detected IcedID
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 246856 Sample: details-1095979.doc Startdate: 19/07/2020 Architecture: WINDOWS Score: 100 67 Multi AV Scanner detection for domain / URL 2->67 69 Multi AV Scanner detection for submitted file 2->69 71 Yara detected IcedID 2->71 73 8 other signatures 2->73 9 WINWORD.EXE 501 77 2->9         started        13 msiexec.exe 2->13         started        process3 file4 49 C:\Users\user\Hoper.vbs, ASCII 9->49 dropped 83 Document exploit detected (creates forbidden files) 9->83 85 Document exploit detected (process start blacklist hit) 9->85 87 Microsoft Office drops suspicious files 9->87 15 rundll32.exe 2 1 9->15         started        17 splwow64.exe 9->17         started        51 C:\Windows\Installer\MSI3381.tmp, PE32 13->51 dropped 53 C:\Windows\Installer\MSI29AC.tmp, PE32+ 13->53 dropped 55 C:\Windows\Installer\MSI22A6.tmp, PE32+ 13->55 dropped 19 msiexec.exe 13->19         started        21 msiexec.exe 13->21         started        signatures5 process6 process7 23 wscript.exe 3 15->23         started        file8 47 C:\Volterbehaviorgraphipotest.bat, ASCII 23->47 dropped 81 Wscript starts Powershell (via cmd or directly) 23->81 27 cmd.exe 1 23->27         started        30 taskkill.exe 1 23->30         started        32 notepad.exe 23->32         started        signatures9 process10 signatures11 89 Suspicious powershell command line found 27->89 91 Wscript starts Powershell (via cmd or directly) 27->91 93 Tries to download and execute files (via powershell) 27->93 34 Trans.exe 29 27->34         started        38 powershell.exe 15 16 27->38         started        41 conhost.exe 27->41         started        43 conhost.exe 30->43         started        process12 dnsIp13 57 www.intel.ch 34->57 59 ldrmars.casa 34->59 65 6 other IPs or domains 34->65 75 Multi AV Scanner detection for dropped file 34->75 77 Contains functionality to detect hardware virtualization (CPUID execution measurement) 34->77 61 haeunkim.com 162.241.225.96, 49727, 80 UNIFIEDLAYER-AS-1US United States 38->61 63 www.haeunkim.com 38->63 45 C:\Volter\Trans.exe, PE32 38->45 dropped 79 Powershell drops PE file 38->79 file14 signatures15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/03aa3045bab94987cc94998a560af28274294d2a1c913b7b04a420acd5a4417b/
Threat name:
Document-Office.Trojan.Powload
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 06:56:05 UTC
AV detection:
11 of 29 (37.93%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aovdarn2xfeypteutgffmcxsqj2cstjkdsitw6yeuqqkzvneif5q._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/200716-y3xbzjwk7s/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious use of WriteProcessMemory
Kills process with taskkill
Suspicious behavior: CmdExeWriteProcessMemorySpam
Delays execution with timeout.exe
Modifies system certificate store
Modifies registry class
Suspicious use of SetWindowsHookEx
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: AddClipboardFormatListener
Suspicious use of FindShellTrayWindow
Modifies registry class
Enumerates system info in registry
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Kills process with taskkill
Delays execution with timeout.exe
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Office loads VBA resources, possible macro or embedded object present
Blacklisted process makes network request
Executes dropped EXE
Executes dropped EXE
Blacklisted process makes network request
Process spawned unexpected child process
Process spawned unexpected child process
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

IcedID

Word file doc 03aa3045bab94987cc94998a560af28274294d2a1c913b7b04a420acd5a4417b

(this sample)

IcedID

Executable exe e22dc7e32dfb8e2f9f75c72dede8b4bbfad86c3e90d03f7b8ffa2d44165afff8

  
URLhaus
https://urlhaus.abuse.ch/url/413384/
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e22dc7e32dfb8e2f9f75c72dede8b4bbfad86c3e90d03f7b8ffa2d44165afff8
  
Dropping
MD5 f9329056c318c4b1be6931135dc76f9e

Comments