Overview

overview

10

Static

static

10

9c53c3c752...JC.exe

windows7-x64

10

9c53c3c752...JC.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9c53c3c75288ff4116cebf689ed52674_icedid_xiaobaminer_JC.exe

  • Size

    775KB

  • Sample

    230808-vrrk4sfh61

  • MD5

    9c53c3c75288ff4116cebf689ed52674

  • SHA1

    d73954339c75be02c5eff314eac3a1f283895c55

  • SHA256

    a503185fda9f0f132fd7b49bfd6998e3f85088840b3a2ae7d64bcf9bcc13f852

  • SHA512

    6be6a08276f6281e4fa41bc363bf64ae832c741a1431c35fcaa299c5a6df866c6bb47cb5cf7e24f0532edee0d1e2895fd42b5211093fa84fe63dc1b1902ae575

  • SSDEEP

    12288:9bu+yrST7EJLbu+yrST7EJWhuhT3VB3NhcQiHmNJLBIuntH:9bByw7EJLbByw7EJKC3TNhiGnBIutH

Score
10/10
blackmoonbankerevasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      9c53c3c75288ff4116cebf689ed52674_icedid_xiaobaminer_JC.exe

    • Size

      775KB

    • MD5

      9c53c3c75288ff4116cebf689ed52674

    • SHA1

      d73954339c75be02c5eff314eac3a1f283895c55

    • SHA256

      a503185fda9f0f132fd7b49bfd6998e3f85088840b3a2ae7d64bcf9bcc13f852

    • SHA512

      6be6a08276f6281e4fa41bc363bf64ae832c741a1431c35fcaa299c5a6df866c6bb47cb5cf7e24f0532edee0d1e2895fd42b5211093fa84fe63dc1b1902ae575

    • SSDEEP

      12288:9bu+yrST7EJLbu+yrST7EJWhuhT3VB3NhcQiHmNJLBIuntH:9bByw7EJLbByw7EJKC3TNhiGnBIutH

    Score
    10/10
    blackmoonbankerevasionpersistencespywarestealertrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

4
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks