Analysis
-
max time kernel
94s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
30-04-2023 04:05
General
-
Target
2023-04-29_084b53f7a0920e455110e6d976c2289b_hacktools_icedid.exe
-
Size
13.5MB
-
MD5
084b53f7a0920e455110e6d976c2289b
-
SHA1
5ec3b3f22afd4c29c3c39aaf227b9f9f6678913c
-
SHA256
36cb93e2d5dfa498df7eee7c14361597d2e838e6b702b6918c8cf3664adf979e
-
SHA512
a77586d05867b715ea7e4711d4ad1fbd5b91ab869a1d1a2782fa658df999b41bd88baebca5b7f1031e291c3baf24679470cb21340f9b33ce11ffd88d945dbbf2
-
SSDEEP
393216:a9yHhd/Ez8IPjlg9wn3NWD3/Dx7okxWmU8U7:awBd/c8UgoMDxMHmU8u
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-04-29_084b53f7a0920e455110e6d976c2289b_hacktools_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2023-04-29_084b53f7a0920e455110e6d976c2289b_hacktools_icedid.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÌìÁúСÃÛ[0430.1].exeC:\Users\Admin\AppData\Local\Temp\ÌìÁúСÃÛ[0430.1].exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ .bat""2⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
165B
MD5da5d0e7ff5fe982f4d8cef8e107a13d2
SHA124f66619a3884fc07954aff87eb4e084ce16d93b
SHA256961f74320f02da0655cf630f95568c2a14062955512ea0379d2d14d62ad4be22
SHA512cd86c081ee9c6c1b3559ed316b475ac5392867710d495a79cf3ed1fd6a14aa18496160927a2207eb90af092e2892ab9277fcc32f37d2a3cf353a03d8382e3d51
-
Filesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
Filesize
1.6MB
MD55870ea0d6ba8dd6e2008466bdd00e0f4
SHA1d41bf60d0dedff90e3cfc1b41b7e1a73df39a7d5
SHA2565a7dac8c8b5d7cf1115246dfaf994e7f50e16a7eac1488642396f5e23fddfe0d
SHA5120c620d5e7383adcf979feccc3b1bad584a5cec8b3d74d0ace8bb786f1f04ba87fa70d59d041dc3833977d44a75f2070181d4054c7c0b9c4ce2d66249b4b3c837
-
Filesize
137KB
MD5f6b847a54cfb804a25b8842b45fd1d50
SHA1bb22fef07ce1577c8a7fa057d8cf05502c013bfc
SHA2565dd2f5a957946e0b6f63660ebd897851aad4795d4c847396c47ddbb647715583
SHA512dd08a55f538e2a33e6a0c496dc97ae9045594cbbf62f7894ae8ded63f4dc0b2e89c5935269adfd1c19607b1d2474bddc49f6acb955e6dc53a55560663ca2137a
-
Filesize
13.6MB
MD5811f3ca6197e1fb57b0a339c73056ae7
SHA120cf6ed71c67b593e86b6fd81845910bb73bac9f
SHA25623ca3d2fe7861fd6f4260d266fb003031aa30f5f92baffc1946805c133821fa8
SHA51242f5a36cb0176f72d2a1b3277fca8b562ba99f45dd277b0a7883c91f8eed9b57ec2c453939747618619d50f56caca3753f03705684c98c269a9159325faa1177
-
Filesize
13.6MB
MD5811f3ca6197e1fb57b0a339c73056ae7
SHA120cf6ed71c67b593e86b6fd81845910bb73bac9f
SHA25623ca3d2fe7861fd6f4260d266fb003031aa30f5f92baffc1946805c133821fa8
SHA51242f5a36cb0176f72d2a1b3277fca8b562ba99f45dd277b0a7883c91f8eed9b57ec2c453939747618619d50f56caca3753f03705684c98c269a9159325faa1177
-
Filesize
10B
MD58e63a3dd3993866cccd5c1741f28016b
SHA15b6edfa8017e1267862a497410882883a17ef81c
SHA256277b14d2f2720f49b7a7f53e27b2ee17694384a4c0ffa78a76a40d1e47af3b3f
SHA512f9751e79987a39227b10c7a7edec2ae269c3645d312acb1bcd87ec4e0b4677a2c9df4d52986555f073663217397c11fa801ce608817315ed74148d756543794e
-
Filesize
72B
MD5d2e34a631a9218349387d46a9f737cd2
SHA105aea73c11bc715058e6f9e4f0a247f12b1abcdc
SHA2567e55963316647ad8136c1a42c3cb94c5a005296ccc7fd6b66cff8cbe742815da
SHA512e997597b735a8bedeb4c0c0bf2845d15790fbfc35d0d407f7e74ceb209b5f17b0f53f56b4c71d0dae17ede564ee9ccdf1c46d7c4839b1925c17ec1f7dca0f720
-
Filesize
72B
MD5d2e34a631a9218349387d46a9f737cd2
SHA105aea73c11bc715058e6f9e4f0a247f12b1abcdc
SHA2567e55963316647ad8136c1a42c3cb94c5a005296ccc7fd6b66cff8cbe742815da
SHA512e997597b735a8bedeb4c0c0bf2845d15790fbfc35d0d407f7e74ceb209b5f17b0f53f56b4c71d0dae17ede564ee9ccdf1c46d7c4839b1925c17ec1f7dca0f720
-
Filesize
3.0MB
MD554da9cb20347baec926b6678f8efb3ab
SHA118ca10861aa561c56666270cca7fd44c73c28d72
SHA256038675d5ee0b22a17a12646ba9cf3fcffd0a2acfb712c1953102671774a82390
SHA512e4608ef1875e2dd46c1352d5e750178ce439725a6b190d37a14decb7e960428841ea3ef5e17488226f9bcfc6d58793cb254f142ba4f54cd316c9cbee50cae77b
-
Filesize
3.0MB
MD554da9cb20347baec926b6678f8efb3ab
SHA118ca10861aa561c56666270cca7fd44c73c28d72
SHA256038675d5ee0b22a17a12646ba9cf3fcffd0a2acfb712c1953102671774a82390
SHA512e4608ef1875e2dd46c1352d5e750178ce439725a6b190d37a14decb7e960428841ea3ef5e17488226f9bcfc6d58793cb254f142ba4f54cd316c9cbee50cae77b
-
Filesize
3.0MB
MD554da9cb20347baec926b6678f8efb3ab
SHA118ca10861aa561c56666270cca7fd44c73c28d72
SHA256038675d5ee0b22a17a12646ba9cf3fcffd0a2acfb712c1953102671774a82390
SHA512e4608ef1875e2dd46c1352d5e750178ce439725a6b190d37a14decb7e960428841ea3ef5e17488226f9bcfc6d58793cb254f142ba4f54cd316c9cbee50cae77b
-
Filesize
3.0MB
MD554da9cb20347baec926b6678f8efb3ab
SHA118ca10861aa561c56666270cca7fd44c73c28d72
SHA256038675d5ee0b22a17a12646ba9cf3fcffd0a2acfb712c1953102671774a82390
SHA512e4608ef1875e2dd46c1352d5e750178ce439725a6b190d37a14decb7e960428841ea3ef5e17488226f9bcfc6d58793cb254f142ba4f54cd316c9cbee50cae77b
-
Filesize
3.0MB
MD554da9cb20347baec926b6678f8efb3ab
SHA118ca10861aa561c56666270cca7fd44c73c28d72
SHA256038675d5ee0b22a17a12646ba9cf3fcffd0a2acfb712c1953102671774a82390
SHA512e4608ef1875e2dd46c1352d5e750178ce439725a6b190d37a14decb7e960428841ea3ef5e17488226f9bcfc6d58793cb254f142ba4f54cd316c9cbee50cae77b
-
Filesize
3.0MB
MD554da9cb20347baec926b6678f8efb3ab
SHA118ca10861aa561c56666270cca7fd44c73c28d72
SHA256038675d5ee0b22a17a12646ba9cf3fcffd0a2acfb712c1953102671774a82390
SHA512e4608ef1875e2dd46c1352d5e750178ce439725a6b190d37a14decb7e960428841ea3ef5e17488226f9bcfc6d58793cb254f142ba4f54cd316c9cbee50cae77b
-
Filesize
6.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.3MB