2020-07-16 (Thursday) - Word docs with macros for IcedID

2020-07-16 (THURSDAY) - WORD DOCS WITH MACROS FOR ICEDID (BOKBOT)

22 EXAMPLES OF WORD DOCS WITH MACRO FOR ICEDID:

- 478d1191f92203ad6218d8fe0ce4bc2037398041348ede79883fb1d0f76b8d93  adjure_07.20.doc
- 936a65fe248db0e965745b5ec3b5bbbd8c585b2f0b0456ff07b4ecc5a15ec403  command-07.20.doc
- cee72540814e77901b176b97945f48a290c020b9112f67762bcae683827c2be3  commerce ,07.20.doc
- eb7862c0ff64eebae5e76505fafc8378455066617262465b6a91aa6f6f6feaa2  deed contract_07.20.doc
- 8107c65cd00056c3e2e3d596bb63c8c38abeeb67a7388e1bb827a6792be54577  details 07.20.doc
- 1c6833985a98a304861e5f419b0adaddd1a76fc61dc1e6f1a0dec6ed38a92a69  dictate,07.20.doc
- 7e507facbc76e4740ba576474fe4f8658bd897170543bb710629c457f9571962  docs.07.16.2020.doc
- f8eee3456a031244b56a8e3c090614291133bd7fb8949450dac33c81c00691c7  document-07.20.doc
- 24cbc6105e6605919a7fc4031c70e9623a4cf8c69625ea2c870f19b2ca39d94d  enjoin,07.16.20.doc
- e0c169656f1ace9ee7b33c86fe89b1002b97b3c36d81e62f901642e253b1adb4  facts,07.20.doc
- 62fcc01c7087d8ff8d718a7aa4943ae260c79a68d77f43dc1061551c48ddd8eb  figures 07.20.doc
- 48002de862fd0663523fc68381da6b6ad3c30e407a4e358f01d913fab471bbd2  figures,07.16.2020.doc
- 0955f51b1403c1db16153606e930f6ccc8fa9721ba5d383876cd643a65734c69  file,07.16.2020.doc
- e20c1c4c8e940461d66d73cb1b667f62660c2e485e98280dd55d931a2c4016b0  input 07.20.doc
- f83ad7e209103fa51223541536f00982ebc64f0b99177a8ab588af64c794c638  inquiry.07.20.doc
- b500e4af65eb9eea068b784f2ff09a2f300f86bea8d09fe4ee8aabd8858c32ed  official paper 07.20.doc
- d497705f023035653e78c80de4f9cc408746c2acebd4dedea37885b1fdc069a7  ordain.07.20.doc
- 9ad814fed86667f207543b4e5c3f9a684ef6e16f40b420a5f4232b1153f33e82  prescribe _07.16.20.doc
- bbfc894be5c7a8f0991e951f728f0ee45f9f6eed8e134e978f833d14c820380a  require.07.16.2020.doc
- 8209ca20bd6f6750b5b37bd626b327f6ada77afe45a662278315887a430d3d3b  rule-07.20.doc
- 09f2711b92acc1bb481d33382309e0f69ec88ce906e6cadb3afaba30a193aef5  specifics 07.16.2020.doc
- 4f72f2946c3ed8fd8df86ef27971705d781a2657eef8fd3cc26530c53e8e4c89  statistics 07.20.doc

DOMAINS HOSTING ICEDID INSTALLER DLL:

- 9qjjytj66p[.]com
- d50y1psaqv[.]com
- jars1umcf5[.]com
- osk4iim2jg[.]com
- pv60oib8e7[.]com
- xakkpl3nwc[.]com
- zxe9tmtff3[.]com

HTTP GET REQUESTS FOR ICEDID INSTALLER DLL:

- GET /hboneb/sol95.php?l=xtm1.cab
- GET /hboneb/sol95.php?l=xtm2.cab
- GET /hboneb/sol95.php?l=xtm3.cab
- GET /hboneb/sol95.php?l=xtm4.cab
- GET /hboneb/sol95.php?l=xtm5.cab
- GET /hboneb/sol95.php?l=xtm6.cab
- GET /hboneb/sol95.php?l=xtm7.cab
- GET /hboneb/sol95.php?l=xtm8.cab
- GET /hboneb/sol95.php?l=xtm9.cab
- GET /hboneb/sol95.php?l=xtm10.cab
- GET /hboneb/sol95.php?l=xtm11.cab
- GET /hboneb/sol95.php?l=xtm12.cab

12 EXAMPLES OF ICEDID INSTLLER DLL FILES:

- 0de955a00a6d5c2c9af0f9c5de06e059362ea4db657680b1a4a8ff7ca1ef7469
- 0e1cfebe2c6c817b44b5d7529f5997db8c61701fd6a5a40c3cb61afd2a0c4d0e
- 13601bc568dabe5036eb4cc0980be5420a5124c8d12fd31b85b88037c288267e
- 18800dee61803d12a92a904d3fedc1b2eca3b2b28a5932976f8e20f1875102a6
- 22a028d138a87ac7c6f7e5eb054032eecddae1a76361c9443095e65fb6f51850
- 253af6bb3c7415b92c05c70a9893ad9cb736d8139c0dfeddce3719a731a7fceb
- 785443266b3911b85a2a6892a30e51111773ad232960accd9d1b62c17c859349
- 74d7c4fe08f186755d032d96d3be7db49aae3307809b9bace9f6658b1879226c
- 82dcc8933fa93bec8b9393115079940d3727e305e0d3a9174d4b879e54580f90
- a850d37d6d33d8e0799cb2c158396c6a9102442d1add1ca2e4d8f1d40f157845
- b783f34e68766095e481eab871562dfada2256d87f18f518f580999eb94fa97c
- bb2e091bd9f8be73501e20b9e05ad014d496482069814628e36abfdd84acb955
- e9e643722767e6dc2458c66e61f6a1ea1aba915bdc52058b06eb89a29aa8fec8

EXAMPLES OF LOCATIONS FOR ICEDID INSTALLER DLL FILES:

- C:\Users\[username]\Documents\Ld.tmp
- C:\ProgramData\44178.jpg

RUN METHOD FOR ICEDID INSTALLER DLL:

- regsvr32.exe [filename]

TRAFFIC GENERATED BY ICEDID INFECTION:

- 45.153.240[.]223 port 443 - ldrtango[.]casa
- 194.5.249[.]158 port 443 - circleoccupy[.]best
- 194.5.249[.]158 port 443 - mramoritto[.]top

ICEDID EXE:

- SHA256 hash: b2c0ad0445ada5704c720204bba4d7c0ea34c5d860d98f207bd16d3ae85bdd67
- File size: 355,328 bytes
- File location: C:\Users\[username]\AppData\Local\Temp\~378578.exe

ICEDID EXE PERSISTENT ON INFECTED HOST:

- SHA256 hash: fa6514c219d45c76ccc2f17cbd31c310cffad7b72df46a6102f70dc92c9989f4
- File size: 355,328 bytes
- File location: C:\Users\[username]\AppData\Roaming\[username]\Azowwu1.exe