Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
29/05/2024, 13:34
General
-
Target
2024-05-29_b946f8bf5db0d31e6ee4c1bcde6b6096_hacktools_icedid.exe
-
Size
9.5MB
-
MD5
b946f8bf5db0d31e6ee4c1bcde6b6096
-
SHA1
df518d1daa224d5a61d58adb3354bb912a0d8c4b
-
SHA256
a0ded4a88e62728739a8b3332c9b68f11d11cd783c06f2a4c2cc12f65e2791b8
-
SHA512
bffd7f54bf012a65158ee971fd49c20da5540273f2ce7718dd1453b726ba3436a238177eacc6c31352e7481132212d6bf3d0f514a6b49fa572ec31186c8b0b70
-
SSDEEP
196608:ZN5JcDKlFBqZcPzFwDxURK8vyqByLdlf3hRQIgLKNc:ZvODKlFBqauayOclfhRQIG2c
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Detects executables packed with VMProtect. 2 IoCs
-
UPX dump on OEP (original entry point) 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_b946f8bf5db0d31e6ee4c1bcde6b6096_hacktools_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_b946f8bf5db0d31e6ee4c1bcde6b6096_hacktools_icedid.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Õù°Ô½ÄÏ\2024-05-29_b946f8bf5db0d31e6ee4c1bcde6b6096_hacktools_icedid.exe"C:\Users\Admin\AppData\Roaming\Õù°Ô½ÄÏ\2024-05-29_b946f8bf5db0d31e6ee4c1bcde6b6096_hacktools_icedid.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Õù°Ô½ÄÏ\63E3B0161EDD6B0047A2D74C4C5B02DF.exe"C:\Users\Admin\AppData\Roaming\Õù°Ô½ÄÏ\63E3B0161EDD6B0047A2D74C4C5B02DF.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55d6b24fdd839a150632957c6b73764bd
SHA19a5e5b2a490aaac65003d397bfbadfc0aa26a601
SHA256c340dc46a67e6623ae63def950505a44daa2a5ccb9b7957044e999457aa33c54
SHA5128df9c50846d5d77122d88dcb4e413fdba8318af24d2e8e234577405cf7d19ba0bba6b0e11eb87907e58a835e811312d01fe98869a593a9c486fe7452f2cfcf23
-
Filesize
9.5MB
MD5b946f8bf5db0d31e6ee4c1bcde6b6096
SHA1df518d1daa224d5a61d58adb3354bb912a0d8c4b
SHA256a0ded4a88e62728739a8b3332c9b68f11d11cd783c06f2a4c2cc12f65e2791b8
SHA512bffd7f54bf012a65158ee971fd49c20da5540273f2ce7718dd1453b726ba3436a238177eacc6c31352e7481132212d6bf3d0f514a6b49fa572ec31186c8b0b70
-
Filesize
9.0MB
MD5a2a1de3e3129ae79f45933a69028dd3c
SHA157b0fd5011fe7dd804a9a18593223d9bfeb90fe2
SHA256fe820f3b0a405f1e6937ff8bfb92b345aefc15ca1723bab965111fd613938515
SHA512f883536c8b6962e60c764b81d369abb8f6a174fe5a1b43adf769ebfdf2433bb0269a757f34153af9377715a2a9f294825877abeb18f9655c56a3a873874f127d