Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
07/06/2024, 19:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-07_261e1f92d8007c1366eca43846e3e99f_icedid_magniber_sakula.exe
Resource
win7-20231129-en
windows7-x64
14 signatures
150 seconds
General
- Target 2024-06-07_261e1f92d8007c1366eca43846e3e99f_icedid_magniber_sakula.exe
- Size 25.5MB
- Sample240607-yldc3sce5w
- SHA256 24b3ec435d9111e33de512dd1f96f4e60088f8d50e63ffad6a849ada781d146f
- MD5 261e1f92d8007c1366eca43846e3e99f
- SHA1 5f00bb4e903db10812d6ec44e155163c0cd09d8a
- SHA512 a48a014a1b5a86d1c638b5d2e8655749cdbb693d66065bbbde6e43f9055858fae8f633ce64233339397dd85b63a2cafde4f68d17d6d5cc5d72dc59139ed3dd34
- SSDEEP 786432:V6di1BEnvQu7vja8IDKrZMu4GwjSB6QJekq/b4S0tk:VsCu7v2jKrWuPwjq6gVftk
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 4 IoCs
resource yara_rule behavioral2/files/0x00090000000233a1-8.dat family_blackmoon behavioral2/memory/4768-22-0x0000000000170000-0x000000000035A000-memory.dmp family_blackmoon behavioral2/memory/4768-25-0x0000000000170000-0x000000000035A000-memory.dmp family_blackmoon behavioral2/memory/4768-30-0x0000000000170000-0x000000000035A000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 7 IoCs
resource yara_rule behavioral2/memory/220-2-0x0000000010000000-0x0000000010014000-memory.dmp UPX behavioral2/memory/220-3-0x0000000010000000-0x0000000010014000-memory.dmp UPX behavioral2/files/0x00090000000233a1-8.dat UPX behavioral2/memory/4768-22-0x0000000000170000-0x000000000035A000-memory.dmp UPX behavioral2/memory/4768-24-0x0000000002E10000-0x0000000002E28000-memory.dmp UPX behavioral2/memory/4768-25-0x0000000000170000-0x000000000035A000-memory.dmp UPX behavioral2/memory/4768-30-0x0000000000170000-0x000000000035A000-memory.dmp UPX - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 2024-06-07_261e1f92d8007c1366eca43846e3e99f_icedid_magniber_sakula.exe - Deletes itself 1 IoCs
pid Process 4768 Tomcat.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WPS.lnk Tomcat.exe - Executes dropped EXE 1 IoCs
pid Process 4768 Tomcat.exe -
resource yara_rule behavioral2/memory/220-2-0x0000000010000000-0x0000000010014000-memory.dmp upx behavioral2/memory/220-3-0x0000000010000000-0x0000000010014000-memory.dmp upx behavioral2/memory/4768-24-0x0000000002E10000-0x0000000002E28000-memory.dmp upx - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 220 2024-06-07_261e1f92d8007c1366eca43846e3e99f_icedid_magniber_sakula.exe 220 2024-06-07_261e1f92d8007c1366eca43846e3e99f_icedid_magniber_sakula.exe 220 2024-06-07_261e1f92d8007c1366eca43846e3e99f_icedid_magniber_sakula.exe 220 2024-06-07_261e1f92d8007c1366eca43846e3e99f_icedid_magniber_sakula.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe 4768 Tomcat.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 4768 Tomcat.exe Token: SeLockMemoryPrivilege 4768 Tomcat.exe Token: SeCreateGlobalPrivilege 4768 Tomcat.exe Token: SeBackupPrivilege 4768 Tomcat.exe Token: SeRestorePrivilege 4768 Tomcat.exe Token: SeShutdownPrivilege 4768 Tomcat.exe Token: SeCreateTokenPrivilege 4768 Tomcat.exe Token: SeTakeOwnershipPrivilege 4768 Tomcat.exe Token: SeDebugPrivilege 4768 Tomcat.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 220 2024-06-07_261e1f92d8007c1366eca43846e3e99f_icedid_magniber_sakula.exe 220 2024-06-07_261e1f92d8007c1366eca43846e3e99f_icedid_magniber_sakula.exe 220 2024-06-07_261e1f92d8007c1366eca43846e3e99f_icedid_magniber_sakula.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 220 wrote to memory of 4768 220 2024-06-07_261e1f92d8007c1366eca43846e3e99f_icedid_magniber_sakula.exe 91 PID 220 wrote to memory of 4768 220 2024-06-07_261e1f92d8007c1366eca43846e3e99f_icedid_magniber_sakula.exe 91 PID 220 wrote to memory of 4768 220 2024-06-07_261e1f92d8007c1366eca43846e3e99f_icedid_magniber_sakula.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-07_261e1f92d8007c1366eca43846e3e99f_icedid_magniber_sakula.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-07_261e1f92d8007c1366eca43846e3e99f_icedid_magniber_sakula.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\Documents\Tomcat.exe"C:\Users\Admin\Documents\Tomcat.exe"2⤵
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Documents\Tomcat.exe
- Size 1.8MB
- SHA256 3ac875e2349006b9f19ac37632db97d2596b0d36411e56aab9ef9e8df79b2b13
- MD5 972d0c82a2a6da0817795d47909e1b6f
- SHA1 54744dfed9db46c8d86ca5b146547549b944fc65
- SHA512 3545d57968bc6aa048a2d83dfd2986dbdb3bd998424a51048d279edab1893f488ed17658c12219000cac6d6493ed54f562439b55669c6a02bfb52593b569f67b
- SSDEEP 49152:RgVCCBnU/eDFOaZym4/I07Slp0sUPYu7UPU:q1nUSQI07QpMAH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Documents\conf.ini
- Size 226B
- SHA256 6275e39ee3b25182e81ee21646e746843abb49f7bbb598550eb680272cf5a3c8
- MD5 0ea16b3ce4c6f91788d3699b1a55eb97
- SHA1 002a78c3ec9b63f1e34ff30d0407a5d36fe87ca1
- SHA512 dc9d02f3f14267fc4874d707a5219752ac36b5e5f6e0b18df5f860f2c758a85ee6a1c4a6f02aae26496148b21e6f7a8ec4521e50dc113b06e6ac66e52ee0385e
- MD5 SHA1 SHA512