blackmoon | 90a900d4e2e9ec7d152959669f82ab23ff485373baf2baa11c05863e434d9818

Analysis

max time kernel
141s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_208e9748f5d0712b088aa7cddf87e4cc_icedid.exe
Size

2.3MB
MD5

208e9748f5d0712b088aa7cddf87e4cc
SHA1

4a6a389eeeac68f656863c2012a0777e02b0fa28
SHA256

90a900d4e2e9ec7d152959669f82ab23ff485373baf2baa11c05863e434d9818
SHA512

23313e605c4aef02b38191f09fd3b5fa88f9a645b5ce176dff477b602b48e1dbf83e06bc47a440dff2a190030f48315c381688b3005f799c97c14baaeaf7a86d
SSDEEP

49152:RpV+mAfpE459XUWixlVkw5d2Bn2ln5Kd5WDAfOJvX4:R+mAfpE459XUWiLVzD2Bn2Gd5WkSX

Score

10^/10

blackmoon banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/928-18-0x0000000000400000-0x000000000068A000-memory.dmp	family_blackmoon

Detects executables packed with VMProtect. 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/928-18-0x0000000000400000-0x000000000068A000-memory.dmp	INDICATOR_EXE_Packed_VMProtect

UPX dump on OEP (original entry point) 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/928-18-0x0000000000400000-0x000000000068A000-memory.dmp	UPX

Suspicious behavior: RenamesItself 1 IoCs

Processes:

2024-05-23_208e9748f5d0712b088aa7cddf87e4cc_icedid.exe

pid process

928 2024-05-23_208e9748f5d0712b088aa7cddf87e4cc_icedid.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2024-05-23_208e9748f5d0712b088aa7cddf87e4cc_icedid.exe

pid process

928 2024-05-23_208e9748f5d0712b088aa7cddf87e4cc_icedid.exe
928 2024-05-23_208e9748f5d0712b088aa7cddf87e4cc_icedid.exe

pid	process
928	2024-05-23_208e9748f5d0712b088aa7cddf87e4cc_icedid.exe

pid	process
928	2024-05-23_208e9748f5d0712b088aa7cddf87e4cc_icedid.exe
928	2024-05-23_208e9748f5d0712b088aa7cddf87e4cc_icedid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_208e9748f5d0712b088aa7cddf87e4cc_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_208e9748f5d0712b088aa7cddf87e4cc_icedid.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/928-7-0x0000000002BE0000-0x0000000002CD0000-memory.dmp

Filesize
960KB

Download
memory/928-8-0x00000000774AF000-0x00000000774B0000-memory.dmp

Filesize
4KB

Download
memory/928-9-0x0000000077490000-0x0000000077580000-memory.dmp

Filesize
960KB

Download
memory/928-6-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/928-5-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/928-4-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/928-3-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/928-2-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/928-1-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/928-0-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/928-12-0x0000000077490000-0x0000000077580000-memory.dmp

Filesize
960KB

Download
memory/928-13-0x0000000077490000-0x0000000077580000-memory.dmp

Filesize
960KB

Download
memory/928-17-0x0000000077490000-0x0000000077580000-memory.dmp

Filesize
960KB

Download
memory/928-16-0x0000000077490000-0x0000000077580000-memory.dmp

Filesize
960KB

Download
memory/928-15-0x0000000077490000-0x0000000077580000-memory.dmp

Filesize
960KB

Download
memory/928-14-0x0000000077490000-0x0000000077580000-memory.dmp

Filesize
960KB

Download
memory/928-18-0x0000000000400000-0x000000000068A000-memory.dmp

Filesize
2.5MB

Download
memory/928-19-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/928-22-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/928-21-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/928-20-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/928-25-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/928-24-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/928-23-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/928-27-0x0000000077490000-0x0000000077580000-memory.dmp

Filesize
960KB

Download
memory/928-28-0x0000000077490000-0x0000000077580000-memory.dmp

Filesize
960KB

Download
memory/928-32-0x0000000077490000-0x0000000077580000-memory.dmp

Filesize
960KB

Download
memory/928-31-0x0000000077490000-0x0000000077580000-memory.dmp

Filesize
960KB

Download
memory/928-30-0x0000000077490000-0x0000000077580000-memory.dmp

Filesize
960KB

Download
memory/928-29-0x0000000077490000-0x0000000077580000-memory.dmp

Filesize
960KB

Download