blackmoon | 93e5c405c3a75cee3ac368c026d5ae9bbd4c9c5be91a95e7c234e4c814c72654

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 12:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-06_d9770c9d89682c53e664786d2dcaa048_hacktools_icedid.exe
Size

4.7MB
MD5

d9770c9d89682c53e664786d2dcaa048
SHA1

168173c8c3b1ead2447519116edeb127f875008f
SHA256

93e5c405c3a75cee3ac368c026d5ae9bbd4c9c5be91a95e7c234e4c814c72654
SHA512

0c1cfc15a2ec13f39a3a2d8277d28ea5444a8593778b6e401027eb9ab4e562f2bf5399a69bcd5a672d7416e01929fb5f6fdf6c8afd11527c50838ed50b4af8d8
SSDEEP

49152:HMwN00ppnsoBTKtKXzdFo8hnK6xPLeBsVu9Cdca7t47FUHhKbieBHuzZ/S9fJpiU:swN9V/TKWfxlcsAAd9OOk2WCZ/kjouL

Score

10^/10

blackmoon banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000e000000012325-4.dat	family_blackmoon

Executes dropped EXE 1 IoCs

pid	Process
2220	TPHelper.exe

Loads dropped DLL 2 IoCs

pid	Process
2468	2024-01-06_d9770c9d89682c53e664786d2dcaa048_hacktools_icedid.exe
2220	TPHelper.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2468	2024-01-06_d9770c9d89682c53e664786d2dcaa048_hacktools_icedid.exe
2468	2024-01-06_d9770c9d89682c53e664786d2dcaa048_hacktools_icedid.exe
2468	2024-01-06_d9770c9d89682c53e664786d2dcaa048_hacktools_icedid.exe
2468	2024-01-06_d9770c9d89682c53e664786d2dcaa048_hacktools_icedid.exe
2468	2024-01-06_d9770c9d89682c53e664786d2dcaa048_hacktools_icedid.exe
2468	2024-01-06_d9770c9d89682c53e664786d2dcaa048_hacktools_icedid.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2468	2024-01-06_d9770c9d89682c53e664786d2dcaa048_hacktools_icedid.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2468	2024-01-06_d9770c9d89682c53e664786d2dcaa048_hacktools_icedid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2220	2468	2024-01-06_d9770c9d89682c53e664786d2dcaa048_hacktools_icedid.exe	28
PID 2468 wrote to memory of 2220	2468	2024-01-06_d9770c9d89682c53e664786d2dcaa048_hacktools_icedid.exe	28
PID 2468 wrote to memory of 2220	2468	2024-01-06_d9770c9d89682c53e664786d2dcaa048_hacktools_icedid.exe	28
PID 2468 wrote to memory of 2220	2468	2024-01-06_d9770c9d89682c53e664786d2dcaa048_hacktools_icedid.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-06_d9770c9d89682c53e664786d2dcaa048_hacktools_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-06_d9770c9d89682c53e664786d2dcaa048_hacktools_icedid.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\Temp\TPHelper.exe
  C:\Users\Admin\AppData\Local\Temp\\TPHelper.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2220-873-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-867-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-19-0x0000000010000000-0x0000000010295000-memory.dmp

Filesize
2.6MB

Download
memory/2220-20-0x0000000075B60000-0x0000000075BA7000-memory.dmp

Filesize
284KB

Download
memory/2220-837-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-849-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-859-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-869-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-879-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-865-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-891-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-887-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-885-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-883-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-881-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-877-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-875-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-2566-0x0000000010000000-0x0000000010295000-memory.dmp

Filesize
2.6MB

Download
memory/2220-18-0x0000000000400000-0x0000000000675000-memory.dmp

Filesize
2.5MB

Download
memory/2220-871-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-889-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-863-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-861-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-857-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-855-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-853-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-851-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-847-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-845-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-843-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-841-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-839-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-835-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-833-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-831-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-830-0x0000000002330000-0x0000000002441000-memory.dmp

Filesize
1.1MB

Download
memory/2220-2567-0x0000000000400000-0x0000000000675000-memory.dmp

Filesize
2.5MB

Download
memory/2468-16-0x00000000024A0000-0x0000000002715000-memory.dmp

Filesize
2.5MB

Download