Behavioral task
behavioral1
Sample
2024-04-23_4b5b2058244eaf6a55ce4dd722617fad_backswap_icedid.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-23_4b5b2058244eaf6a55ce4dd722617fad_backswap_icedid.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-23_4b5b2058244eaf6a55ce4dd722617fad_backswap_icedid
-
Size
2.6MB
-
MD5
4b5b2058244eaf6a55ce4dd722617fad
-
SHA1
a40a6ed831510ae9d19f2ac2db0fd519ebbe1691
-
SHA256
40e2615b967c45d75abb75a0baea8d04167107c7c840096f3d4c48df4c4d14a6
-
SHA512
9bed66c4f5d4988f49998d1e432c369eef9b4fac7279e542bf1b3537d5ceb135e4997094c15d071dde94d85149e5a23ce286c818d61b6af8cb6ba25d2358c80d
-
SSDEEP
24576:5nWYXDaHMv6CorjqnyPQGzh0JONZejOuC+e4mOzrvxiI3ENyesg/jHLxQVIxX6LF:tl1vqjdPQRw/D4mizA0dizLrB51vQ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule sample autoit_exe -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-04-23_4b5b2058244eaf6a55ce4dd722617fad_backswap_icedid
Files
-
2024-04-23_4b5b2058244eaf6a55ce4dd722617fad_backswap_icedid.exe windows:4 windows x86 arch:x86
9d5552b3a103c723c650b0d7a6310980
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapReAlloc
HeapFree
IsBadReadPtr
GetTickCount
CloseHandle
ReadFile
GetFileSize
FindClose
FindNextFileA
DeleteFileA
RemoveDirectoryA
FindFirstFileA
Sleep
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
HeapAlloc
FormatMessageA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
GetCurrentProcessId
TerminateProcess
OpenProcess
ExitProcess
GetModuleHandleA
CreateProcessA
MoveFileA
CreateDirectoryA
GetModuleFileNameA
CreateFileA
GetUserDefaultLCID
lstrcpyn
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
SetFilePointer
GetOEMCP
GetACP
GetCPInfo
VirtualAlloc
RaiseException
LCMapStringW
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
WriteFile
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExA
GetLastError
GetCurrentProcess
GetStartupInfoA
GetVersion
InterlockedDecrement
InterlockedIncrement
RtlUnwind
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
user32
PeekMessageA
GetMessageA
TranslateMessage
MessageBoxA
DispatchMessageA
wsprintfA
advapi32
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
CryptGetHashParam
ole32
CoUninitialize
OleRun
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoInitialize
shlwapi
PathFileExistsA
oleaut32
VariantChangeType
VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SysFreeString
VarR8FromCy
VarR8FromBool
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
SysAllocString
VariantClear
SafeArrayDestroy
SafeArrayCreate
shell32
SHGetSpecialFolderPathA
Sections
.text Size: 80KB - Virtual size: 77KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ