Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2024-01-06...id.exe

windows7-x64

10

2024-01-06...id.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/01/2024, 12:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-01-06_d9770c9d89682c53e664786d2dcaa048_hacktools_icedid.exe

  • Size

    4.7MB

  • MD5

    d9770c9d89682c53e664786d2dcaa048

  • SHA1

    168173c8c3b1ead2447519116edeb127f875008f

  • SHA256

    93e5c405c3a75cee3ac368c026d5ae9bbd4c9c5be91a95e7c234e4c814c72654

  • SHA512

    0c1cfc15a2ec13f39a3a2d8277d28ea5444a8593778b6e401027eb9ab4e562f2bf5399a69bcd5a672d7416e01929fb5f6fdf6c8afd11527c50838ed50b4af8d8

  • SSDEEP

    49152:HMwN00ppnsoBTKtKXzdFo8hnK6xPLeBsVu9Cdca7t47FUHhKbieBHuzZ/S9fJpiU:swN9V/TKWfxlcsAAd9OOk2WCZ/kjouL

Score
10/10
blackmoonbankertrojan

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon
  • Detect Blackmoon payload 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-06_d9770c9d89682c53e664786d2dcaa048_hacktools_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-06_d9770c9d89682c53e664786d2dcaa048_hacktools_icedid.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:624
    • C:\Users\Admin\AppData\Local\Temp\TPHelper.exe
      C:\Users\Admin\AppData\Local\Temp\\TPHelper.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4944
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 484
        3⤵
        • Program crash
        PID:2212
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4944 -ip 4944
    1⤵
      PID:1836

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\2024-01-06_d9770c9d89682c53e664786d2dcaa048_hacktools_icedid.exe{A178C657-1F02-4a42-A8E6-82BB2ADBA258}
      Filesize

      1024KB

      MD5

      bfa64b89eba95b52cb5051c57e5ed77e

      SHA1

      b49ce0fe3d59326fd3115e958962499e32f540c9

      SHA256

      2067ab09eceb4ee8a765c88b6335fe576b90b380eef0d0dac5f2e898cdbbba6f

      SHA512

      1d70fc86cb28c19a3e6f4ed036707105cd18b3272167e783ea9e4de0aad16a483482934a65ee4af599c8ca93042fb455ae60d531b066034250ce3d7bb44069d6

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\TPHelper.exe
      Filesize

      129KB

      MD5

      1c785857cdfad05ace89e55ed8a4f879

      SHA1

      27b652984570233abae8d3a7ec162dcb517f4a63

      SHA256

      bb25cac95eaa235437433d2f76d1fb37f1d5c11a588b76ecb889c51655048bf9

      SHA512

      77b39f6255f1946e11c5faa26ba8fbb9a02a0e75d661ccc38669ea64533b89d82cfff3440f9c809b9624321e3184286ac75f34f7f6e19454f3acc5f1623d4929

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\TPHelper.exe
      Filesize

      101KB

      MD5

      c4402b8ee571ae05e9c782c75b7d7856

      SHA1

      b7f43dee6004c3d85dd766646ba79062b308d898

      SHA256

      2f55950c1391c3f36d80fc21e2bf68a14d4330b525702ab3654bc686e6fdc722

      SHA512

      13939338278e1b8cee5a8bb7b0c1e684a42086939303e5ecea72fe34f98d011ef201fdc75d0c7d442499b46f19f640ba0bdccaed198b8ca0eca352b9f65be92b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\TPHelperBase.dll
      Filesize

      577KB

      MD5

      1f78e077b33b404a8db64aababe0599d

      SHA1

      44eb8e7db4a18897b695d710ef23dd02252afccf

      SHA256

      54b9a897f94a0827c26566ae9053e9abd32b706284707915e9d6e61d3da5a053

      SHA512

      696ed92521421e19e1d3a5b55a0f8fd3d95c7b0853f625a407856ee89aab27abfb65bc61b408feaa416d64cc606b574bb3d581645f790077414bc60aa88028ae

      Download Submit

    • memory/4944-16-0x0000000000400000-0x0000000000675000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/4944-17-0x0000000010000000-0x0000000010295000-memory.dmp

      Filesize

      2.6MB

      Download

    • memory/4944-18-0x0000000075D20000-0x0000000075F35000-memory.dmp

      Filesize

      2.1MB

      Download

    • memory/4944-3892-0x0000000010000000-0x0000000010295000-memory.dmp

      Filesize

      2.6MB

      Download

    • memory/4944-3893-0x0000000000400000-0x0000000000675000-memory.dmp

      Filesize

      2.5MB

      Download