Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
19-04-2024 13:27
General
-
Target
2024-04-19_821ade96f211c8e5e170341e0c7bf95b_icedid.exe
-
Size
4.7MB
-
MD5
821ade96f211c8e5e170341e0c7bf95b
-
SHA1
5959705dc9a1e6ac4919eb88a36e38bee8a5b099
-
SHA256
c39a91b1798facada14cd8e34fb1b9515e38cb157986bb0671a085bd316916f4
-
SHA512
8db4efe9fb764f65776ae672b4bdbf835a60883a1da6ec75f8e95dd7c60b6967eccae53037b8a4844ee3dbd19513f303474822092b78a41c1b675627297617c2
-
SSDEEP
49152:tfJWqbKNJ7UfY99lzHsw/ps+dVmq6uQM9ScUz53wJWqu2Nv61Ai2oB9Kgk6EaXtd:5JW+KNJoirAcyETNCSiLKwESgjMxSaRf
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 4 IoCs
-
Detects Windows executables referencing non-Windows User-Agents 4 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-19_821ade96f211c8e5e170341e0c7bf95b_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-19_821ade96f211c8e5e170341e0c7bf95b_icedid.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2932-1-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/2932-22-0x0000000000400000-0x00000000008E4000-memory.dmpFilesize
4.9MB
-
memory/2932-24-0x0000000000400000-0x00000000008E4000-memory.dmpFilesize
4.9MB
-
memory/2932-28-0x0000000000400000-0x00000000008E4000-memory.dmpFilesize
4.9MB
-
memory/2932-32-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/2932-33-0x0000000000400000-0x00000000008E4000-memory.dmpFilesize
4.9MB