Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 16:12
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_43bdb340047d2fcb3ba663bbc072a3e2_icedid.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-24_43bdb340047d2fcb3ba663bbc072a3e2_icedid.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-24_43bdb340047d2fcb3ba663bbc072a3e2_icedid.exe
-
Size
1.0MB
-
MD5
43bdb340047d2fcb3ba663bbc072a3e2
-
SHA1
b6633647b9754f2c9cdaed07fe2bdbfc4d69d784
-
SHA256
5efdd03f432f24a995f87cc0f1eaa97a8a155ac99dd151e956cba5c39e4cce83
-
SHA512
a6ee634e2597dd73eb9b364edcaedcc533e53b0cc602e31c16674fde8a5ef76feee9e6a1f9a37de54285b2f34b8e8e358480e7e04acfdf4f9e2470d01e8e28c1
-
SSDEEP
24576:s25BWpxNYQOqHxpYMZ05+1fInsHrcrSQKQx5DJx/gZxx+/xzxxOxx6pxrkCmzTfC:s25B7TqF05ognsHrgX
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2676-0-0x0000000010000000-0x0000000010023000-memory.dmp family_blackmoon behavioral1/memory/2676-1-0x0000000010000000-0x0000000010023000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 15 IoCs
Processes:
resource yara_rule behavioral1/memory/2676-0-0x0000000010000000-0x0000000010023000-memory.dmp UPX behavioral1/memory/2676-1-0x0000000010000000-0x0000000010023000-memory.dmp UPX behavioral1/memory/2676-5-0x0000000000400000-0x0000000000531000-memory.dmp UPX behavioral1/memory/2676-6-0x0000000000400000-0x0000000000531000-memory.dmp UPX behavioral1/memory/2676-7-0x0000000000400000-0x0000000000531000-memory.dmp UPX behavioral1/memory/2676-8-0x0000000000400000-0x0000000000531000-memory.dmp UPX behavioral1/memory/2676-9-0x0000000000400000-0x0000000000531000-memory.dmp UPX behavioral1/memory/2676-10-0x0000000000400000-0x0000000000531000-memory.dmp UPX behavioral1/memory/2676-11-0x0000000000400000-0x0000000000531000-memory.dmp UPX behavioral1/memory/2676-12-0x0000000000400000-0x0000000000531000-memory.dmp UPX behavioral1/memory/2676-13-0x0000000000400000-0x0000000000531000-memory.dmp UPX behavioral1/memory/2676-14-0x0000000000400000-0x0000000000531000-memory.dmp UPX behavioral1/memory/2676-15-0x0000000000400000-0x0000000000531000-memory.dmp UPX behavioral1/memory/2676-16-0x0000000000400000-0x0000000000531000-memory.dmp UPX behavioral1/memory/2676-17-0x0000000000400000-0x0000000000531000-memory.dmp UPX -
Processes:
resource yara_rule behavioral1/memory/2676-0-0x0000000010000000-0x0000000010023000-memory.dmp upx behavioral1/memory/2676-1-0x0000000010000000-0x0000000010023000-memory.dmp upx -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
2024-05-24_43bdb340047d2fcb3ba663bbc072a3e2_icedid.exepid process 2676 2024-05-24_43bdb340047d2fcb3ba663bbc072a3e2_icedid.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
2024-05-24_43bdb340047d2fcb3ba663bbc072a3e2_icedid.exepid process 2676 2024-05-24_43bdb340047d2fcb3ba663bbc072a3e2_icedid.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2024-05-24_43bdb340047d2fcb3ba663bbc072a3e2_icedid.exepid process 2676 2024-05-24_43bdb340047d2fcb3ba663bbc072a3e2_icedid.exe 2676 2024-05-24_43bdb340047d2fcb3ba663bbc072a3e2_icedid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_43bdb340047d2fcb3ba663bbc072a3e2_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_43bdb340047d2fcb3ba663bbc072a3e2_icedid.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2676-0-0x0000000010000000-0x0000000010023000-memory.dmpFilesize
140KB
-
memory/2676-1-0x0000000010000000-0x0000000010023000-memory.dmpFilesize
140KB
-
memory/2676-2-0x0000000076011000-0x0000000076012000-memory.dmpFilesize
4KB
-
memory/2676-3-0x0000000076000000-0x0000000076110000-memory.dmpFilesize
1.1MB
-
memory/2676-5-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/2676-6-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/2676-7-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/2676-8-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/2676-9-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/2676-10-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/2676-11-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/2676-12-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/2676-13-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/2676-14-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/2676-15-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/2676-16-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/2676-17-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB