Overview

overview

10

Static

static

10

2024-05-24...id.exe

windows7-x64

10

2024-05-24...id.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    133s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-05-2024 16:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-24_47cf857b24c72a1bba3c55e7ed8e6924_icedid.exe

  • Size

    8.6MB

  • MD5

    47cf857b24c72a1bba3c55e7ed8e6924

  • SHA1

    2a3a77793d4671d93861cd069d0919cedadc2d6e

  • SHA256

    b51b2e8c45fa3fb71adcca4de3011a6333abf798a6cb9a6e55c218b648f40495

  • SHA512

    cf329e2d3459d4add3459971c3ee35a9bfafdaafb3eff60be29f3db4dacc88f951d6fe24f26d00ed0f81e424b52b78120aea4467f0c25a2aa0550000d997cafb

  • SSDEEP

    98304:ol9oLCqqJvb+0CAds6uipFNIhgWteZGHo2bjocPew1yC/LOCQN0odU46UB:4ds6WHt2GI6jocPeXC/SiUF

Score
10/10
blackmoonbankertrojan

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon
  • Detect Blackmoon payload 1 IoCs
  • Detects executables packed with ASPack 1 IoCs
  • UPX dump on OEP (original entry point) 1 IoCs
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-24_47cf857b24c72a1bba3c55e7ed8e6924_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-24_47cf857b24c72a1bba3c55e7ed8e6924_icedid.exe"
    1⤵
      PID:2200
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 220
        2⤵
        • Program crash
        PID:2500
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2200 -ip 2200
      1⤵
        PID:2892
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4124,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:8
        1⤵
          PID:3720

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2200-0-0x0000000000400000-0x0000000001357000-memory.dmp
          Filesize

          15.3MB

          Download