blackmoon | 2024-05-25_660f7d844275e8d0b2c9f831755db780_icedid

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-25_660f7d844275e8d0b2c9f831755db780_icedid
Size

672KB
MD5

660f7d844275e8d0b2c9f831755db780
SHA1

0b068866d1e4b81369046f77692f2be9bb6b2ca2
SHA256

cc2c1eafd81c16669f4cfc540922171f82fc96df81677f831c40978248b9d598
SHA512

36d26893d88e628176479265f51d1f4ab89c2c6e5135e8f03128806558130fdd3c62aa3059bbcce3f4788f6d334cf7e4e4a09b06791d7bddf2c0c53c6c3681c5
SSDEEP

12288:7sgojVC0jcI0JNvYMR5nWFpPoS9aTP4r44wxDUY:7sgEVC0jpINg/bqsTwJ

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-25_660f7d844275e8d0b2c9f831755db780_icedid

Files

2024-05-25_660f7d844275e8d0b2c9f831755db780_icedid
.exe windows:4 windows x86 arch:x86

8266deca2090ed6bf6bf29c08ed144d3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeLibrary
LCMapStringA
DeleteFileA
FormatMessageA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetCommandLineA
CreateFileA
WriteFile
CloseHandle
GetModuleFileNameA
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetStdHandle
IsBadCodePtr
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
IsBadWritePtr
LCMapStringW
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetACP
HeapSize
RaiseException
GetLocalTime
GetSystemTime
GetTimeZoneInformation
ExitThread
CreateThread
RtlUnwind
GetStartupInfoA
IsBadReadPtr
HeapReAlloc
ExitProcess
WideCharToMultiByte
LocalSize
HeapAlloc
HeapFree
GetProcessHeap
VirtualFree
GetProcAddress
LoadLibraryA
VirtualAlloc
RtlMoveMemory
lstrcpynA
MultiByteToWideChar
SetWaitableTimer
CreateWaitableTimerA
GetCurrentProcessId
TerminateProcess
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
lstrcpyn
GetOEMCP
GetCPInfo
SetEndOfFile
FlushFileBuffers
SetFilePointer
ReadFile
SetErrorMode
GetProcessVersion
FindResourceA
LoadResource
LockResource
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
SetLastError
InterlockedIncrement
lstrcpyA
lstrcatA
WritePrivateProfileStringA
InterlockedDecrement
GlobalFlags
MulDiv
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
GlobalDeleteAtom
lstrcmpA
GetTickCount
GetLastError
Sleep
GetCurrentThreadId
MapViewOfFile
CreateFileMappingA
LocalFree
TerminateThread
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
UnmapViewOfFile
lstrlenA
GetVersionExA
GetCurrentProcess
GetCurrentThread
lstrcmpiA
GetModuleHandleA

user32

SendMessageA
DefMDIChildProcA
LoadCursorA
SetCursor
DestroyWindow
EndDialog
GetClientRect
DefWindowProcA
GetAsyncKeyState
CallWindowProcA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
SetMenuDefaultItem
SetMenuItemBitmaps
SetMenuItemInfoA
CheckMenuItem
RemoveMenu
MenuItemFromPoint
GetMenuDefaultItem
GetMenuInfo
GetMenuState
GetMenuItemRect
GetMenuItemInfoA
GetMenuStringA
TrackPopupMenu
SetForegroundWindow
CheckMenuRadioItem
GetMenuItemID
GetSubMenu
SetMenuInfo
InsertMenuA
GetMenuItemCount
AppendMenuA
DestroyMenu
LoadMenuA
GetSystemMenu
CreatePopupMenu
TrackMouseEvent
DestroyIcon
PostQuitMessage
SetWindowLongA
DestroyCursor
CreateWindowExA
EndPaint
IsWindow
GetClassNameA
SetFocus
GetFocus
GetWindowRect
GetParent
ScreenToClient
InvalidateRect
ValidateRect
UpdateWindow
MoveWindow
SetWindowPos
SetParent
IsWindowVisible
ShowWindow
IsWindowEnabled
GetForegroundWindow
GetActiveWindow
SetActiveWindow
GetLastActivePopup
SetWindowsHookExA
GetCursorPos
CallNextHookEx
GetKeyState
GetNextDlgTabItem
EnableMenuItem
ModifyMenuA
LoadBitmapA
GetMenuCheckMarkDimensions
RegisterClipboardFormatA
PtInRect
GetDlgCtrlID
GetWindow
ClientToScreen
UnhookWindowsHookEx
TabbedTextOutA
DrawTextA
GrayStringA
IsDialogMessageA
GetWindowPlacement
SystemParametersInfoA
GetMessagePos
GetMessageTime
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
AdjustWindowRectEx
MapWindowPoints
GetSysColorBrush
LoadStringA
UnregisterClassA
PostThreadMessageA
CreateDialogIndirectParamA
CreateMenu
ReleaseDC
GetDC
GetDialogBaseUnits
SendDlgItemMessageA
SetDlgItemTextA
GetDlgItemTextA
SetDlgItemInt
GetDlgItemInt
CreateDialogParamA
DialogBoxParamA
GetClassInfoExA
RegisterClassExA
UnregisterHotKey
RegisterHotKey
RegisterWindowMessageA
BeginPaint
PostMessageA
MsgWaitForMultipleObjects
KillTimer
SetTimer
GetDlgItem
LoadIconA
GetWindowLongA
EnableWindow
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
MessageBoxA
SetPropA
GetPropA
RemovePropA
SetWindowRgn
SetRect
GetClassLongA
SetClassLongA
FillRect
GetSysColor
IsIconic
IsZoomed
GetSystemMetrics
GetMenu
SetMenu
DrawMenuBar

shell32

ShellExecuteA
DragQueryFileA
DragFinish
Shell_NotifyIconA
DragAcceptFiles

ole32

CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
CoRegisterMessageFilter
CLSIDFromString
CoFreeUnusedLibraries
OleUninitialize
OleInitialize

atl

ord42
ord11
ord10
ord47

shlwapi

PathFileExistsA
PathMatchSpecA
PathFindFileNameA
PathRemoveFileSpecA

comctl32

InitCommonControlsEx
ord17

gdi32

DeleteObject
GetStockObject
GetObjectA
CreateCompatibleDC
CreateDIBSection
DeleteDC
SelectObject
BitBlt
ExtCreateRegion
CombineRgn
CreateRoundRectRgn
StretchBlt
CreateSolidBrush
CreatePatternBrush
SetTextColor
SetBkMode
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
SetBkColor
GetDeviceCaps
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
RestoreDC
SaveDC
CreateBitmap

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

oledlg

ord8

oleaut32

SafeArrayDestroy
VariantClear
VariantChangeType
VariantInit
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
VarR8FromCy
VarR8FromBool
SafeArrayCreate
SysAllocString

ws2_32

accept
listen
bind
htons
WSAGetLastError
ioctlsocket
socket
WSAStartup
closesocket
connect
inet_addr
__WSAFDIsSet
select
recv
send
gethostname
getsockname
ntohs
gethostbyname
inet_ntoa

advapi32

RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey

Sections

.text
Size: 280KB - Virtual size: 278KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 352KB - Virtual size: 458KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8266deca2090ed6bf6bf29c08ed144d3

Headers

File Characteristics

Imports

kernel32

user32

shell32

ole32

atl

shlwapi

comctl32

gdi32

winspool.drv

oledlg

oleaut32

ws2_32

advapi32

Sections

.text Size: 280KB - Virtual size: 278KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 352KB - Virtual size: 458KB

.rsrc Size: 12KB - Virtual size: 11KB

.text
Size: 280KB - Virtual size: 278KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 352KB - Virtual size: 458KB

.rsrc
Size: 12KB - Virtual size: 11KB