Behavioral task
behavioral1
Sample
72242a2ceac1573f23a34cb4e0cd6d69_backswap_icedid_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
72242a2ceac1573f23a34cb4e0cd6d69_backswap_icedid_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
72242a2ceac1573f23a34cb4e0cd6d69_backswap_icedid_JC.exe
-
Size
2.6MB
-
MD5
72242a2ceac1573f23a34cb4e0cd6d69
-
SHA1
137dec2d6b87a76affd3e7a359d37bd191f63d81
-
SHA256
61b5303feb469223d5a3891c190e9b0e49786cc59408074e8f5e0ea6101ba257
-
SHA512
da8117ca7e9290af8f177e126ff8a6b802d4ba65e110533ee6a084a962cc3c182deb8b10b34b06743ef1b685d75f2d368d3f63a2aa8e533b4478d92bfbccb46a
-
SSDEEP
24576:5nWYXDaHMv6CorjqnyPQGzh0JONZejOuC+e4mOzrvxiI3ENyesg/jHLxQVIxX6LP:tl1vqjdPQRw/D4mizA0dizLrB51vG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule sample autoit_exe -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 72242a2ceac1573f23a34cb4e0cd6d69_backswap_icedid_JC.exe
Files
-
72242a2ceac1573f23a34cb4e0cd6d69_backswap_icedid_JC.exe.exe windows x86
9d5552b3a103c723c650b0d7a6310980
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapReAlloc
HeapFree
IsBadReadPtr
GetTickCount
CloseHandle
ReadFile
GetFileSize
FindClose
FindNextFileA
DeleteFileA
RemoveDirectoryA
FindFirstFileA
Sleep
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
HeapAlloc
FormatMessageA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
GetCurrentProcessId
TerminateProcess
OpenProcess
ExitProcess
GetModuleHandleA
CreateProcessA
MoveFileA
CreateDirectoryA
GetModuleFileNameA
CreateFileA
GetUserDefaultLCID
lstrcpyn
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
SetFilePointer
GetOEMCP
GetACP
GetCPInfo
VirtualAlloc
RaiseException
LCMapStringW
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
WriteFile
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExA
GetLastError
GetCurrentProcess
GetStartupInfoA
GetVersion
InterlockedDecrement
InterlockedIncrement
RtlUnwind
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
user32
PeekMessageA
GetMessageA
TranslateMessage
MessageBoxA
DispatchMessageA
wsprintfA
advapi32
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
CryptGetHashParam
ole32
CoUninitialize
OleRun
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoInitialize
shlwapi
PathFileExistsA
oleaut32
VariantChangeType
VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SysFreeString
VarR8FromCy
VarR8FromBool
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
SysAllocString
VariantClear
SafeArrayDestroy
SafeArrayCreate
shell32
SHGetSpecialFolderPathA
Sections
.text Size: 80KB - Virtual size: 77KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ