Analysis
-
max time kernel
148s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
24-05-2024 07:33
General
-
Target
2024-05-24_5eb78d52d3ea9a67f973310ae04c6995_icedid_xiaobaminer.exe
-
Size
3.8MB
-
MD5
5eb78d52d3ea9a67f973310ae04c6995
-
SHA1
8858f0fc05f9e3eba239b8fc76d6a4ba46f5b6d0
-
SHA256
d01769f29f26665a6503c66f52aeab5c5ea51144f1946cd05c43b74b9965beb1
-
SHA512
91fad6237752944c8af969353bf0684b5f2fc9cb9855d41012f11ebcfc3d1f8172e3c694e3d1df39292caa741034948fa0dbfb08b94e392ef7d5f4568b96b9a8
-
SSDEEP
49152:7bCknzcErNNQJLxgjI45TMwwapIgThpYqc/7t0i0FZaUm8cikL6:SXPLapIK6JnUm8UO
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 7 IoCs
-
UAC bypass 3 TTPs 1 IoCs
-
Adds policy Run key to start application 2 TTPs 1 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Drops file in Drivers directory 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops autorun.inf file 1 TTPs 6 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
System policy modification 1 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5eb78d52d3ea9a67f973310ae04c6995_icedid_xiaobaminer.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_5eb78d52d3ea9a67f973310ae04c6995_icedid_xiaobaminer.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"2⤵
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3816,i,16488180140590516186,11762960689811837350,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exeFilesize
3.8MB
MD55eb78d52d3ea9a67f973310ae04c6995
SHA18858f0fc05f9e3eba239b8fc76d6a4ba46f5b6d0
SHA256d01769f29f26665a6503c66f52aeab5c5ea51144f1946cd05c43b74b9965beb1
SHA51291fad6237752944c8af969353bf0684b5f2fc9cb9855d41012f11ebcfc3d1f8172e3c694e3d1df39292caa741034948fa0dbfb08b94e392ef7d5f4568b96b9a8
-
C:\vcredist2010_x86.log.htmlFilesize
81KB
MD505bba02abdd1ae6f95b7fbd0571115df
SHA1b790b581dffd799a151af203f4eeb12af3543ee5
SHA25687c0a5b712b02e30fc8a6d2ca8f9f09fea306760e34857283f4ea6d76c68f302
SHA512fb779b9fbfa6e468e5a3d568b45a7bb26c8f58d11adcf7061037a627552344d20199bf6260175114cceee0a2d7dd6e76371cfe62e1d020a1267aebf5c5762ff6
-
memory/3292-15-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/3292-380-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/3292-519-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4616-0-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4616-1-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4616-11-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB