blackmoon | 9b99d65ad5c5fed0bf7ee7ec1f2aa9c015190a9d3a08ae0e7276735e5334c30a

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 06:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe
Size

2.0MB
MD5

46ab5f6a3dc7b4ea0385a5fe7ec06e5d
SHA1

edfa63e3b56382b84c506840351b8e18c432ad4d
SHA256

9b99d65ad5c5fed0bf7ee7ec1f2aa9c015190a9d3a08ae0e7276735e5334c30a
SHA512

ef05ce8da4dc8a1138eac7a2b4b362991640fb6b5b68599b67eeaf49d20642d799497fe74fd2be7395fa2e11df5c42330b840ddbe09ecd43fe5fb7a3b0cc536f
SSDEEP

24576:nSH25PwcN2jx23LdZNtWFKVYIdaY5VFt1LuqJhDqGFeyUQPurCD8JYjSK5ECe:nlDoOTNtGKiIvfuRVy/Pur2Mge

Score

10^/10

blackmoon banker bootkit persistence trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 17 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012270-5.dat	family_blackmoon
behavioral1/files/0x0008000000016d33-22.dat	family_blackmoon
behavioral1/files/0x0032000000016ced-33.dat	family_blackmoon
behavioral1/files/0x0032000000016ced-36.dat	family_blackmoon
behavioral1/files/0x0032000000016ced-37.dat	family_blackmoon
behavioral1/files/0x0032000000016ced-38.dat	family_blackmoon
behavioral1/files/0x0032000000016ced-39.dat	family_blackmoon
behavioral1/files/0x0032000000016ced-40.dat	family_blackmoon
behavioral1/files/0x0009000000012270-44.dat	family_blackmoon
behavioral1/files/0x0032000000016ced-58.dat	family_blackmoon
behavioral1/files/0x0032000000016ced-87.dat	family_blackmoon
behavioral1/files/0x0032000000016ced-90.dat	family_blackmoon
behavioral1/files/0x0032000000016ced-89.dat	family_blackmoon
behavioral1/files/0x0032000000016ced-88.dat	family_blackmoon
behavioral1/files/0x0032000000016ced-86.dat	family_blackmoon
behavioral1/files/0x0009000000012270-94.dat	family_blackmoon
behavioral1/files/0x0032000000016ced-120.dat	family_blackmoon

Deletes itself 1 IoCs

pid	Process
1648	cmd.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\360tray.lnk	ippatch.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IP.lnk	ipsee.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\360tray.lnk	ippatch.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IP.lnk	ipsee.exe

Executes dropped EXE 3 IoCs

pid	Process
2816	ippatch.exe
1528	ipsee.exe
780	ippatch.exe

Loads dropped DLL 64 IoCs

pid	Process
2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe
780	ippatch.exe
780	ippatch.exe
780	ippatch.exe
1528	ipsee.exe
780	ippatch.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe
1528	ipsee.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe
File opened for modification	\??\PhysicalDrive0	ippatch.exe
File opened for modification	\??\PhysicalDrive0	ippatch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 13 IoCs

evasion

pid	Process
1544	taskkill.exe
1116	taskkill.exe
1636	taskkill.exe
2364	taskkill.exe
1372	taskkill.exe
2440	taskkill.exe
2052	taskkill.exe
2348	taskkill.exe
1424	taskkill.exe
484	taskkill.exe
2928	taskkill.exe
1600	taskkill.exe
2344	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe
2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
1528	ipsee.exe
2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe
2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe
2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe
1528	ipsee.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe
2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe
2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
1528	ipsee.exe
1528	ipsee.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe
2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe
1528	ipsee.exe
1528	ipsee.exe
2816	ippatch.exe
2816	ippatch.exe
2816	ippatch.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2928	taskkill.exe
Token: SeDebugPrivilege	2440	taskkill.exe
Token: SeDebugPrivilege	1600	taskkill.exe
Token: SeDebugPrivilege	2052	taskkill.exe
Token: SeDebugPrivilege	2344	taskkill.exe
Token: SeDebugPrivilege	2348	taskkill.exe
Token: SeDebugPrivilege	1544	taskkill.exe
Token: SeDebugPrivilege	1372	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2712	DllHost.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe
2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe
2816	ippatch.exe
2816	ippatch.exe
1528	ipsee.exe
1528	ipsee.exe
780	ippatch.exe
780	ippatch.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2928	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	29
PID 2036 wrote to memory of 2928	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	29
PID 2036 wrote to memory of 2928	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	29
PID 2036 wrote to memory of 2928	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	29
PID 2036 wrote to memory of 2440	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	30
PID 2036 wrote to memory of 2440	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	30
PID 2036 wrote to memory of 2440	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	30
PID 2036 wrote to memory of 2440	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	30
PID 2036 wrote to memory of 2816	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	34
PID 2036 wrote to memory of 2816	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	34
PID 2036 wrote to memory of 2816	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	34
PID 2036 wrote to memory of 2816	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	34
PID 2036 wrote to memory of 2816	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	34
PID 2036 wrote to memory of 2816	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	34
PID 2036 wrote to memory of 2816	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	34
PID 2816 wrote to memory of 1600	2816	ippatch.exe	36
PID 2816 wrote to memory of 1600	2816	ippatch.exe	36
PID 2816 wrote to memory of 1600	2816	ippatch.exe	36
PID 2816 wrote to memory of 1600	2816	ippatch.exe	36
PID 2816 wrote to memory of 1600	2816	ippatch.exe	36
PID 2816 wrote to memory of 1600	2816	ippatch.exe	36
PID 2816 wrote to memory of 1600	2816	ippatch.exe	36
PID 2816 wrote to memory of 1528	2816	ippatch.exe	37
PID 2816 wrote to memory of 1528	2816	ippatch.exe	37
PID 2816 wrote to memory of 1528	2816	ippatch.exe	37
PID 2816 wrote to memory of 1528	2816	ippatch.exe	37
PID 2816 wrote to memory of 1528	2816	ippatch.exe	37
PID 2816 wrote to memory of 1528	2816	ippatch.exe	37
PID 2816 wrote to memory of 1528	2816	ippatch.exe	37
PID 2036 wrote to memory of 780	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	38
PID 2036 wrote to memory of 780	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	38
PID 2036 wrote to memory of 780	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	38
PID 2036 wrote to memory of 780	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	38
PID 2036 wrote to memory of 780	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	38
PID 2036 wrote to memory of 780	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	38
PID 2036 wrote to memory of 780	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	38
PID 2036 wrote to memory of 2052	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	46
PID 2036 wrote to memory of 2052	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	46
PID 2036 wrote to memory of 2052	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	46
PID 2036 wrote to memory of 2052	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	46
PID 2036 wrote to memory of 1116	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	39
PID 2036 wrote to memory of 1116	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	39
PID 2036 wrote to memory of 1116	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	39
PID 2036 wrote to memory of 1116	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	39
PID 2036 wrote to memory of 2344	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	45
PID 2036 wrote to memory of 2344	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	45
PID 2036 wrote to memory of 2344	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	45
PID 2036 wrote to memory of 2344	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	45
PID 2036 wrote to memory of 1636	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	42
PID 2036 wrote to memory of 1636	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	42
PID 2036 wrote to memory of 1636	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	42
PID 2036 wrote to memory of 1636	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	42
PID 2036 wrote to memory of 2348	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	47
PID 2036 wrote to memory of 2348	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	47
PID 2036 wrote to memory of 2348	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	47
PID 2036 wrote to memory of 2348	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	47
PID 2036 wrote to memory of 2364	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	50
PID 2036 wrote to memory of 2364	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	50
PID 2036 wrote to memory of 2364	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	50
PID 2036 wrote to memory of 2364	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	50
PID 2036 wrote to memory of 1544	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	51
PID 2036 wrote to memory of 1544	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	51
PID 2036 wrote to memory of 1544	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	51
PID 2036 wrote to memory of 1544	2036	2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe	51

C:\Users\Admin\AppData\Local\Temp\2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im ippatch.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2928
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im ipsee.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2440
- C:\Users\Admin\AppData\Roaming\ippatch.exe
  "C:\Users\Admin\AppData\Roaming\ippatch.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im ipsee.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1600
- - C:\Users\Admin\AppData\Roaming\ipsee.exe
    "C:\Users\Admin\AppData\Roaming\ipsee.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1528
- C:\Users\Admin\AppData\Roaming\ippatch.exe
  "C:\Users\Admin\AppData\Roaming\ippatch.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  PID:780
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im QQ .EXE /f
  2⤵
  - Kills process with taskkill
  PID:1116
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im QQ .EXE /f
  2⤵
  - Kills process with taskkill
  PID:1636
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im QQ.EXE /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2344
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im QQ.EXE /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2052
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im QQ.EXE /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2348
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im QQ .EXE /f
  2⤵
  - Kills process with taskkill
  PID:2364
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im QQ.EXE /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1544
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im QQ .EXE /f
  2⤵
  - Kills process with taskkill
  PID:1424
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im QQ .EXE /f
  2⤵
  - Kills process with taskkill
  PID:484
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im QQ.EXE /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1372
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe_And DeleteMe.bat""
  2⤵
  - Deletes itself
  PID:1648

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2024-01-29_46ab5f6a3dc7b4ea0385a5fe7ec06e5d_hacktools_icedid.exe_And DeleteMe.bat

Filesize
238B

MD5
314e447afca07ac84f904cc3302ea067

SHA1
0ff6dc15d087522c5705de670d6349b20540b0e4

SHA256
ec9bf677e2def5d994ed4c49db893018dc2152c2ef0eadc5f231ed2fb8a03e12

SHA512
f29345650931790eaba204c5d9b7c2b95556e9c205afd378eef32d220578730a31759b454da8ad410524a5a9a2c06eeb92f5157100fb38888f2aeb896652f42a

Download Submit
C:\Users\Admin\AppData\Roaming\1.jpg

Filesize
53KB

MD5
3e6a6eef02a43bab4e580c30fa8ddf05

SHA1
6893ca9f204ccac1b625229e2f270856077ae755

SHA256
33264a92e66ea4bc57ddcf38bf8807f4e98656091d47f2cafafc67459411babb

SHA512
5033b65b07d91669d7f7cbeb17f1659ba9947d16b73468ea83c7e091875c42f898f7e24ed1a3732857adb9a372452b709c4021e224d6f56a4b1aa7125dc0c5b9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\360tray.lnk

Filesize
692B

MD5
bd361f51d9a9fffd33a0be2bed681191

SHA1
5b862cc7c65764d6d77b6e7f827efab50a4a3b77

SHA256
9a3d49f5f54d7683b7dbc1bc6a92d9251e086ba54b45832e444518472afcdfb9

SHA512
665e5440b9ed56693e67dd255c5c14a6ce95809b65f6dd6f34e113d9a7793cecfe6f9d61e3a14d7a835754990e0ea2ae66a939f89d431ffa6abf826a1e7136b4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IP.lnk

Filesize
680B

MD5
f2e3714b14a8dcf89b1dd698f09c0f8f

SHA1
4ba6583abdf15bdfd5ee63d376e5e9d079b5d8ca

SHA256
83ab2bd049f7985096ef9a90c1f7a57883fcb96ce093054d701b304977b5a02e

SHA512
952bbcca1441942bb7845aaac18ea304367f372f207e9ef0d7277288de29da4b41cab2645972e044baf0c848c34b2620dc622ac540e3866d29350c8c74026ef4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\yhxx.dll

Filesize
154B

MD5
40b80bda339faae4739d77caa3ebd0eb

SHA1
54e11813769d714dbf3153ec6f2620b919a00fca

SHA256
c551be73cdf086d8b11a4b92910c939cec35e1a8805ee3099b18c5a26f14aff3

SHA512
ab087ef1fb1a60772dcd091dc45a47d5b3f5f17f3aa6ae0f1293983b4015a7b1217e69bea95d6f3e4085962f8ef3ca3f529e76d083ab805648aa1bb76480e376

Download Submit
C:\Users\Admin\AppData\Roaming\RCX4A99.tmp

Filesize
2.0MB

MD5
95594aae92674cf5c4942fce943bd7d8

SHA1
3cc524ef9e9b4d3fa8f5501e8288abf4e0df6901

SHA256
79fa8a6467f401a9baf1d27879e0067eb418a4db8135862511bcbc745e658ff5

SHA512
b5c0e406890c74cb9795625df3fce9aa1fcc424f6bf46cab1937c8419dd4399cb4682b9266615d5b636a57dfeec2428dce7cc59fa2e20ee473828835724f8383

Download Submit
C:\Users\Admin\AppData\Roaming\ippatch.exe

Filesize
858KB

MD5
a7cf9d5ad2dd1f90b9610a3b0bc4db8c

SHA1
64c0d4eef78c44c4ca4debe21f1f9757c62fb02f

SHA256
2d77187da44a66078cfe1b2d726bdec133f47bfe4cb47a37368b3dd3b8324a74

SHA512
007f80e4a72bfd6b29b67bc60cdc8ba9740dcbba96b92886749750ad847ea357b43346635df8949ad1dc83c07d5bb44fb42eb6037b28438eeefe2221c4a9bfd8

Download Submit
C:\Users\Admin\AppData\Roaming\ippatch.exe

Filesize
759KB

MD5
c2e41f2b76e3a160581fd676673e7485

SHA1
15ab4127c7dca6c86c8963a23000845b6f72705f

SHA256
acc6a08079d2607c044a96e7bc0e5a6b2c44934f57cf04ae2658c15559bab1da

SHA512
adbf496b44db25feac21876836e1d01183bcf8b8862b455849e7c9b1d019e120335f1fd861d7a1cb9dbaf7a1c111f68def3a71f7dd060ef5bdb5fa4ee6e9bb7a

Download Submit
C:\Users\Admin\AppData\Roaming\ippatch.exe

Filesize
166KB

MD5
6ae34eeae155f50bbd03a72597c0a89d

SHA1
a8aa8b1492375e7843a8d6e2a901b51bb41ad558

SHA256
99257778ed43788045c9b958ea596156cf1af39370c233d5285c609bc6ce7d72

SHA512
f0042ea18d2621e42f56e92ff334412a6646f7db7a678a0eaf30f9ed5f87373eb9f22276dd6287e376670121e75051a3edc42faa8ee18b06417156a2d454d76d

Download Submit
C:\Users\Admin\AppData\Roaming\ipsee.exe

Filesize
9KB

MD5
81668d31070de143f788a9ad7c100c58

SHA1
a4c7a8175972f8b3261cbdae7aebf98f5679050a

SHA256
21290a33810eb0a7433f1d5b34f1f7ee34e93c6052fbd455642e4f3de01040eb

SHA512
495b97fd841ef4a37f77f4125ec68ac2cb7d00279913e5341d74df70799c670cefeff886b721bc22f3462a320b5173e8c6e70069925d9f17d48318d72b662702

Download Submit
C:\Users\Admin\AppData\Roaming\ipsee.exe

Filesize
377KB

MD5
3f7ec0f955953b97c3fb86cd472e9bed

SHA1
def476743889c7c57ffaff60ddae699ff3cd91bc

SHA256
93b3bb536d8302a5bf8008df6fc2e730815e0b811c4b4ac56508724b8de4117f

SHA512
134f6f34b6cb9315f29e96393ef195c08c8cc568a3bf60b5c09c31af4cdd646f3e5cf1c89f46524702efab0f7aba7c922400488b55e30acb9fb7a1d1b9bbe3a5

Download Submit
C:\Users\Admin\AppData\Roaming\ipsee.exe

Filesize
384KB

MD5
7eb1cd2ff9b48cad322bfeccb07ac994

SHA1
1ef16dcafc7fe4ad0f5e14c827eaebbf738651cb

SHA256
540187258902d8cc15defbdb783a253eb120f1547beab21974322cce97147778

SHA512
ed1f0b7549aafa4f339699328b01bfdac26b7a7cb07cd966221a22c9c0d5c25ef0e66a0ef1bd6d0c18ff1406f11981c2a37068cb81bca7c0c05f804bad4d9989

Download Submit
C:\Users\Admin\AppData\Roaming\mydll.dll

Filesize
178KB

MD5
ec82cea0b75eacb31fb7235153a656fa

SHA1
7b01a1621daf1ca8677bf791eebeb0b2407fb757

SHA256
bb60ab07a4c551b97873555ecb81045c9dc9f04f3f30dd053296167f03ae7685

SHA512
40beed4ef2c1e3b303016dd220ad41f3e5d2e4857a377ccb41a52a6870d4b6db510f43e62f2d1925908acd7984c1e492c576676be755233a1e2c7fd04ca50e2a

Download Submit
C:\Users\Admin\AppData\Roaming\mydll.dll

Filesize
256KB

MD5
e6e7e434524699b8e3c6a681f349d8cb

SHA1
fe183a7142f5b7850f07278c69a8d8bd0490cc69

SHA256
b1eb1ea930692820ae4086f59fc315944900f36cf19ad63dbb5c00089a14850a

SHA512
4c7f1c5376485b0a510031a450ba6cd0153ea27af0e0853e25affe768715146332705725b35ea01d3b343a67ef605c9c9b9a19ffe28ca9e4c3d76ccc7df8658e

Download Submit
C:\Users\Admin\AppData\Roaming\mydll.dll

Filesize
126KB

MD5
3e3629bbf8543ea3270ddecad4df3383

SHA1
b8e007b3a75ca518c915fc4e7a11d4f0f5663e3d

SHA256
9232e86771e24f857fe2f27ea80b4d52784fda87c6dd42422f7c507307de3390

SHA512
421ceca36ce89d1f93288366b863a0e1c9553a95debdf1ee093c03c066c727032769bebb2d8216dde1c3f855a7251e32477a60b7b1e40a923eea9acb94e8568e

Download Submit
\Users\Admin\AppData\Roaming\ippatch.exe

Filesize
105KB

MD5
b4b829de0093949a76230fe552270743

SHA1
fc8d0eb6153053f2388fb9a376aebf7ca5bcded0

SHA256
b40b3c4e5009cc046bbcbb3800c6d5203919988639dd84f9ce4f4b1c12495fb2

SHA512
4d2a4fe1431facfc770676d1a4424157e43082ed8223e9a961061a849b1800bdcb3e8ca4fa48980c47ecb3c6b26cdbbdb54c9ba89919b368ffc7f91779cf012a

Download Submit
\Users\Admin\AppData\Roaming\ippatch.exe

Filesize
1.8MB

MD5
cf8a9b4ef6bb5a632fac53d1154aa60d

SHA1
417a59e8e78602c1c6ba40c46dfbd1c70bafa815

SHA256
82c18c4493f20dd943d4bc18d0e4f1242af58488b552f624dbb36aef7d30ac17

SHA512
b09568157c4946a301e3d23b6fc36d06a8dad49fd3a5e84b7bff74dddb4d84ec4dc8060213878355590cce5b26679259660cd9824232d4b2417bbae5ef696863

Download Submit
\Users\Admin\AppData\Roaming\ippatch.exe

Filesize
302KB

MD5
1d8587befe5b8ae1b4afaa005b59e18f

SHA1
98d46aa5fe73a63212e54691d00f4760456d0fe0

SHA256
ba79fd6f6ecd8d42831b78064f6ee0b59e083737af84b8ac1173b91d3e4e42d1

SHA512
4f47f3a70501fcfa2bd8ce059f657406f28e0d28f90d0de2749a43b3446694761985f5b5d9deed65fe685ec9e8ef1b6829f0cc4814b3c0ab2dbe2e3354d8e844

Download Submit
\Users\Admin\AppData\Roaming\ippatch.exe

Filesize
307KB

MD5
f12b49de34ce5fc1566f1850280bc44a

SHA1
b054416a2d5b5485d388981ce9a30198165fd808

SHA256
eec999dbd3d10ca65b99960ed6c92728eea6baa88085e7bf7bfb49ef0fbeeb7e

SHA512
e88c25765a42f67a159063af7aa9bc5c1beed1f03d8d828ccee689cab23f66cd5f4e9611b67b942e8714dbbd2d1ca1bf553ee868622621e96e9321254d4d3156

Download Submit
\Users\Admin\AppData\Roaming\ippatch.exe

Filesize
378KB

MD5
7c9b7bcc9f072c0bbb76bdee089b6969

SHA1
fba3220e2413940889222f927618d5a4ff897dec

SHA256
0848bb3f58f1be2c7c50f17033eace1858b440899e876a8b56f74c9e1f4b372a

SHA512
6e76b53298e5ea2961417950525851ae7d5426beebdb3cb674b92f275b8b6e4296c29e125067c28df86b04ddbf51dfaede2e850b50e2e664a1b90948dbe18400

Download Submit
\Users\Admin\AppData\Roaming\ippatch.exe

Filesize
97KB

MD5
e4ddbd0f577fb2e2d23c20eb80de8496

SHA1
0d85e8a5db3f97624fda5c0f94582cfae9bea317

SHA256
21f49ed97023dafac3410fdd7afeea898d05553052096428c66700793bac68d5

SHA512
11dd6686ebb7a75deb375e434cab62e99febe474bbbbc080755457e64ac09c0d0194c5185909bc6a0f2b594718c00f818cc4e291e1710e16dfa1364621badf80

Download Submit
\Users\Admin\AppData\Roaming\ippatch.exe

Filesize
191KB

MD5
f2ffdf9efc5f1338b6832b42a59efb5b

SHA1
892e5631fd3cb94366faae1c8ec6364fc8f399fe

SHA256
064972a74341db0cea197bbc29dedee3f05f4c81b921f26272f3c49770f00a16

SHA512
8b77590da7f653484c355243359043a4062f9e6a7af1fbf8b4aed6ceeb36837076be7a818918ce5eaf0b39e75cf6db996b389dfcd6566d28e9da23d0179ef7d3

Download Submit
\Users\Admin\AppData\Roaming\ippatch.exe

Filesize
236KB

MD5
7b47f3101e67f10137edad9a5b399955

SHA1
780ce9b09af8563b1271c16d4bce4a86d507373a

SHA256
bee760bfe2dbf370aa3317b7404fab4437d32646a3400e5dd3e6aecb77b5e9a8

SHA512
ca2080a512110575fa6c7ad84bf161c9511ab9f7d8170184063877a6ce5b87e7bfa1f6a8c893666ce1cda87198d15936938cc6b2016e03b790ea18b269404e77

Download Submit
\Users\Admin\AppData\Roaming\ippatch.exe

Filesize
305KB

MD5
6d07016824b7c45430da057c13d4a8a1

SHA1
0ce3d8d95914b76e0a0dec714e4b078c5e34aa09

SHA256
15e3904ad62c9346689272fa6657a17e84d7fff55466b8c44b3e382f6245fb6f

SHA512
868d36e6fc4338067db022876cf6f4bba75f7f6fd7708684b8671be77f7ab708e143e92063156b4a09c8d1e965bbb77291f6766fb35f2858e28d954e0c573b4c

Download Submit
\Users\Admin\AppData\Roaming\ippatch.exe

Filesize
288KB

MD5
075bf5c557f99ab01baf195a2ca9bcfe

SHA1
afbacf3eb9f66d6cbfd1870ce56b195f8a388496

SHA256
ded60baab62bdf0be807d32d2052e173cd18c1a3150498b9b5cc4fcf6e85232c

SHA512
af7260fc0240adf14a32096f6d943176ca2932737e0f12c257cfcf25d7f9633f880c618a52184ed76f685bf37448950f0061ab7e5d915b25cd7bd186b0984225

Download Submit
\Users\Admin\AppData\Roaming\ipsee.exe

Filesize
153KB

MD5
16c09cf5a0ea8bed23cf0c1051d68784

SHA1
680619f88c57f2621c0631a24b5a6351da4ffe86

SHA256
9324f7201069b49d8137cc24f18ae59a4218768817c79ce7a3885ab7e4f7425e

SHA512
79616098886f7c9487f4fe8940fd737d52891fbc9242f747ce9659dea3ee97e913e086d0775fd9efc4c26abe88ba9ebb95300f3956e8e24e3e527aef1fb3af37

Download Submit
\Users\Admin\AppData\Roaming\ipsee.exe

Filesize
719KB

MD5
15102458342d4ee8024f82e7a56eb10f

SHA1
f725a5a35b71cc563ee9d406caf5ad7aef59ba98

SHA256
ff977fa93896c3380f6b04586eb19f39d73625caa02e8f13911d91ac38777bc6

SHA512
ad229da2b9e35206e15f4f7697a4640f1464d377c1bf2f40b7a133f8bf332c833f0ca2e389fde9055c9ec1cad51b8ca16ddbae2fe3f479b041022a8a984de2d7

Download Submit
\Users\Admin\AppData\Roaming\ipsee.exe

Filesize
322KB

MD5
b012b8a208df2bc2f8b32bcc7b09f950

SHA1
e930d1e1b97df4817e41abc47f96afce58f9452e

SHA256
53d9d87132759956acbe77a7e100a14ae239447478ecffee5a0e0f4b7e5e9db1

SHA512
438461809ddfe78e75e6247435da88a7fcd27b1ca21e6654a4f8b03a95980561288bcda3837b985448b16a6164b20aabf01ad8a428fcd356f92b656e5393fc33

Download Submit
\Users\Admin\AppData\Roaming\ipsee.exe

Filesize
66KB

MD5
c677cd0a5317d0ab16afb6c5c45935ba

SHA1
6854b3aa3aaa5a22305bd8f190a15d4833422759

SHA256
63054f0da2e6d910cdd4f3a14dd8c5e2befe777bb2a69d1d8cea414a779b20f2

SHA512
faa0c820526afead95346e8ace08041de45e5858820003d22b559fbece120ee78cd9618ec772e466530cdfa07a968c5a950fe6138c57c63a3158f12b93c73b7c

Download Submit
\Users\Admin\AppData\Roaming\ipsee.exe

Filesize
868KB

MD5
ca663ffeea73d26938e20a4b8e8c394b

SHA1
8982fb4e735025437082778f36a92438961d776b

SHA256
e16e9cc5246eefa53687269317c44bd48f070afde36f543305d8f1e1e7f10141

SHA512
045c991ff83c8784b79555d341f452ba35374fd355f3801cec1972104cb74cae2b278d98057b4856a68534b1aa22231856566b507ab03e871e7f546f3f960947

Download Submit
\Users\Admin\AppData\Roaming\ipsee.exe

Filesize
115KB

MD5
558d960b3b75a90433400a936b86093a

SHA1
a6153152f188de161245724213eebc3ebec8e141

SHA256
f9f8389e3d371ca2517422a08e46682c0964098ba89885a493671b9ee95fbf03

SHA512
7ae6ebda104246de8b0e76b5b10fe4d00d8d93abc341e597cd1fa10af26c05609512ced786ffc78cc5181c72b2e5df6873c1fc02772b63c01d5741de59360247

Download Submit
\Users\Admin\AppData\Roaming\ipsee.exe

Filesize
440KB

MD5
96f38483141c59c75a43149ade5fda6b

SHA1
cb41a22b9a627273ddb33ee8590ca5428fef7fb2

SHA256
6a0ae6f6b6e0d78bf94e4788a6be90b68d91c2f93b69709c3dc9a89511385240

SHA512
cc1d2a4f82c314676ff88f52fb51523f12aae164b17a922da441bc86530356339e4178b201c67637895a69f281741a24a338c6f3346461d33781dbf8ef048bcc

Download Submit
\Users\Admin\AppData\Roaming\ipsee.exe

Filesize
303KB

MD5
08bd07aae0fd270eedbcde45356907d6

SHA1
4d41f2baeadabdaccc9135bc8cd93fc2d4f2707c

SHA256
9dd097fd1f4154408b6593a75c19974fd8f4230b1afef2d2a7afc5083522daeb

SHA512
dd6b4d8e9ff6ffc858dde96e2245bf65e1e62bc43706eb28bc50ff90c0bcd6209710e4bb3758eef85959c11a0a6b393fa32c70c74e204915a52d484357577dc0

Download Submit
\Users\Admin\AppData\Roaming\ipsee.exe

Filesize
272KB

MD5
e85329c64acb25c30191947e9b876450

SHA1
9ce916537883f4e45946162535d78b7a90fd7cab

SHA256
bf9c48a9104196c1765aa5b3ae3e976a16bb680b3aff9228191f30ef11de39a5

SHA512
d1fc253da992b2c4bf78b47ef5be3044bc633e05935196824d4a151dd46d249fbad4862e76b65d00d92c9d8c49a42344481c7cc8784b5d07da6eab115c9830c6

Download Submit
\Users\Admin\AppData\Roaming\ipsee.exe

Filesize
259KB

MD5
1095f491cc9f022d877ac3302a9336c8

SHA1
94df26d7b8ade5415731fdfa34a43079b47843c1

SHA256
89357355afb1cb259bb6ca2cecc7079a8d4681383f2fb614b2918a4b79c793b1

SHA512
5fa05047fde7f460f80385c9eed7c346feb1cd1f01fc1c8edde1976e18a5603ef458bce7d96ab60207e8fbcd9daa0aafa10cc7ac645fc5126c55a06006e20e1f

Download Submit
\Users\Admin\AppData\Roaming\ipsee.exe

Filesize
161KB

MD5
ad32f5cdb191c72e7834e494ccb2206c

SHA1
a6b9733ed4c6c4c57a7aec46e879e231d9c3c61f

SHA256
b0cfe3d96f4de0775fc030d00dcc6ccb3145e11e665be2fc105521f5e9e6dc41

SHA512
6c0faa1b5e526b4b3286921a9e063f9cca41fccae6bf4dc289b0051e577acda32707d6340372bb7f0a9f89def4e5bd13938ef6c8282d514c6da726d3e5844bed

Download Submit
memory/2036-15-0x0000000002270000-0x0000000002272000-memory.dmp

Filesize
8KB

Download
memory/2712-17-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2712-16-0x0000000000170000-0x0000000000172000-memory.dmp

Filesize
8KB

Download
memory/2712-253-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download