blackmoon | 2024-06-19_6fa337b3cab016188245cb1c504d51f9_icedid_nymaim

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-19_6fa337b3cab016188245cb1c504d51f9_icedid_nymaim
Size 22.5MB
Sample240619-vadmxstfkh
SHA256 7cbf26469b4cb3dfa1752ad92e8aa5a5416c8ce754ecfb670e1c563617ef4e3e
MD5 6fa337b3cab016188245cb1c504d51f9
SHA1 3d054d1cfe8f8732bec2807e5b1558ca34a51c08
SHA512 144ba63849282271d382e4dfd6fa2b9ea58d57e5509a854fe9ee38e41dda13d88b22cdd2a72cda0d78641d46f3678e28151f2f43c8f4aabcf678b73d793a3d58
SSDEEP 393216:dGiNFLk+SheGxMXc00HW7rNc00H/4wS7rncclEja1:dDNFLYhzp2HGpgzHnccV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-19_6fa337b3cab016188245cb1c504d51f9_icedid_nymaim

File Explorer

2024-06-19_6fa337b3cab016188245cb1c504d51f9_icedid_nymaim

.exe 22.5MB

2024-06-19_6fa337b3cab016188245cb1c504d51f9_icedid_nymaim

IMPHASH 19bbac746db0bc74d798de4c2a52df40
SHA256 7cbf26469b4cb3dfa1752ad92e8aa5a5416c8ce754ecfb670e1c563617ef4e3e
MD5 6fa337b3cab016188245cb1c504d51f9
SHA1 3d054d1cfe8f8732bec2807e5b1558ca34a51c08
SHA512 144ba63849282271d382e4dfd6fa2b9ea58d57e5509a854fe9ee38e41dda13d88b22cdd2a72cda0d78641d46f3678e28151f2f43c8f4aabcf678b73d793a3d58
SSDEEP 393216:dGiNFLk+SheGxMXc00HW7rNc00H/4wS7rncclEja1:dDNFLYhzp2HGpgzHnccV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect Blackmoon payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1517583

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

iphlpapi

GetAdaptersInfo

winmm

PlaySoundA waveOutRestart midiStreamRestart midiStreamClose midiOutReset midiStreamStop waveOutUnprepareHeader waveOutPrepareHeader waveOutWrite waveOutPause waveOutReset midiStreamOut midiOutPrepareHeader midiStreamProperty midiStreamOpen midiOutUnprepareHeader waveOutOpen waveOutGetNumDevs waveOutClose

ws2_32

gethostname inet_addr gethostbyname WSAStartup WSACleanup select send closesocket WSAAsyncSelect htons bind htonl socket setsockopt sendto recvfrom ioctlsocket connect recv listen getpeername WSASetLastError __WSAFDIsSet ntohs getsockname shutdown WSAGetLastError ntohl accept inet_ntoa

rasapi32

RasGetConnectStatusA RasHangUpA

msvfw32

DrawDibDraw

avifil32

AVIStreamInfoA AVIStreamGetFrame

kernel32

GetTimeZoneInformation GetLocaleInfoA GetVersion TerminateThread FileTimeToSystemTime WideCharToMultiByte IsDBCSLeadByte lstrcmpA lstrcmpiA lstrcpynA UnmapViewOfFile MapViewOfFile CreateFileMappingA FlushViewOfFile CreateMutexA ReleaseMutex SuspendThread InterlockedIncrement InterlockedDecrement GetSystemInfo IsProcessorFeaturePresent LocalFree FileTimeToLocalFileTime DuplicateHandle FlushFileBuffers LockFile UnlockFile SetEndOfFile GlobalDeleteAtom GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA LocalAlloc TlsAlloc GlobalHandle TlsFree TlsSetValue LocalReAlloc TlsGetValue GetFileTime GetCurrentThread GlobalFlags SetErrorMode GetProcessVersion GetCPInfo GetOEMCP GetStartupInfoA RtlUnwind GetSystemTime GetLocalTime RaiseException GetFileType HeapSize GetACP SetStdHandle UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree SetEnvironmentVariableW SetEnvironmentVariableA LCMapStringA LCMapStringW VirtualAlloc IsBadWritePtr SetUnhandledExceptionFilter GetStringTypeA GetStringTypeW IsValidLocale IsValidCodePage EnumSystemLocalesA GetCurrentProcessId CompareStringA CompareStringW IsBadReadPtr IsBadCodePtr GetLocaleInfoW SetNamedPipeHandleState WaitNamedPipeA OpenFileMappingA OpenEventA SetLastError MultiByteToWideChar GetSystemDirectoryA GetWindowsDirectoryA TerminateProcess GetCurrentProcess GetFileSize SetFilePointer CreateToolhelp32Snapshot Process32First Process32Next CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource ReadFile lstrlenW RemoveDirectoryA GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GetDriveTypeA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetUserDefaultLCID GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA WritePrivateProfileStringA GetPrivateProfileStringA CreateThread CreateEventA Sleep ExpandEnvironmentStringsA GlobalAlloc GlobalLock GlobalUnlock GetTempPathA FindFirstFileA FindClose GetFileAttributesA MoveFileA DeleteFileA GetCurrentDirectoryA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount CreateProcessA WaitForSingleObject CloseHandle InterlockedExchange

user32

GetSysColorBrush GetMenuCheckMarkDimensions GetMenuState SetMenuItemBitmaps CheckMenuItem MoveWindow IsDialogMessageA ScrollWindowEx SendDlgItemMessageA MapWindowPoints AdjustWindowRectEx GetScrollPos RegisterClassA GetMenuItemCount GetMenuItemID SetWindowsHookExA CallNextHookEx GetClassLongA SetPropA UnhookWindowsHookEx GetPropA RemovePropA GetMessageTime GetLastActivePopup RegisterWindowMessageA GetWindowPlacement EndDialog CreateDialogIndirectParamA DestroyWindow GrayStringA DrawTextA TabbedTextOutA EndPaint BeginPaint GetWindowDC GetWindowTextLengthA UnregisterHotKey RegisterHotKey CreateWindowExA CallWindowProcA CharUpperA DrawStateA FrameRect GetNextDlgTabItem GetForegroundWindow SetWindowTextA GetWindowTextA FindWindowExA UnregisterClassA GetClassNameA GetDesktopWindow LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem ClientToScreen EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetClassInfoA DefWindowProcA GetSystemMenu DeleteMenu GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos SetRect InflateRect IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBoxA GetCursorPos GetSystemMetrics EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA WaitForInputIdle LoadStringA CreateIconFromResourceEx GetWindowLongA GetDlgItem

gdi32

GetPolyFillMode GetStretchBltMode GetROP2 GetBkColor GetBkMode GetTextColor CreateRoundRectRgn CreateEllipticRgn PathToRegion EndPath BeginPath GetWindowOrgEx GetViewportOrgEx CreateCompatibleBitmap CreateDCA GetWindowExtEx CreateBitmap CreatePatternBrush SelectObject CreatePen GetDIBits PatBlt CombineRgn CreateRectRgn RealizePalette FillRgn TranslateCharsetInfo SaveDC RestoreDC SetPolyFillMode CreateSolidBrush SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx CreateFontIndirectA GetClipBox ExcludeClipRect MoveToEx LineTo ExtSelectClipRgn GetViewportExtEx PtVisible RectVisible ExtTextOutA Escape GetTextMetricsA SetBkMode TextOutA SetBkColor CreateRectRgnIndirect CreateDIBSection SetPixel ExtCreateRegion SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette GetStockObject GetObjectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt GetPixel CreateCompatibleDC Ellipse Rectangle ScaleWindowExtEx CreateFontA LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A SetDIBitsToDevice SetROP2 GetDeviceCaps SetTextColor

winspool.drv

OpenPrinterA ClosePrinter DocumentPropertiesA

comdlg32

GetFileTitleA GetSaveFileNameA ChooseColorA GetOpenFileNameA

advapi32

RegCreateKeyExA RegEnumValueA RegOpenKeyA RegQueryValueA RegCreateKeyA RegSetValueExA RegOpenKeyExA RegQueryValueExA RegCloseKey

shell32

DragAcceptFiles DragFinish DragQueryFileA ShellExecuteA Shell_NotifyIconA SHGetSpecialFolderPathA

ole32

CLSIDFromProgID OleInitialize OleUninitialize CLSIDFromString CoCreateInstance OleRun

oleaut32

VariantCopy VariantClear VariantChangeType SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetDim SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetElement VariantCopyInd VariantInit SysAllocString SafeArrayDestroy SafeArrayCreate SafeArrayPutElement RegisterTypeLi LHashValOfNameSys LoadTypeLi UnRegisterTypeLi

comctl32

ImageList_EndDrag ImageList_DragShowNolock ImageList_DragMove ImageList_DragLeave ImageList_DragEnter _TrackMouseEvent ImageList_Add ImageList_BeginDrag ImageList_Create ord17 ImageList_Destroy

wsock32

getservbyname

wininet

InternetCloseHandle

generic

count=9, id=11, version=8047,

count=6, id=10, version=8047,

count=14, id=12, version=7291,

count=44, id=19, version=8022,

count=1, id=11, version=8966,

count=74, id=10, version=8966,

count=49, id=14, version=7299,

count=1, id=28, version=9178,

count=117, id=29, version=9178,

count=9, id=95, version=2067,

count=32, id=19, version=8034,

count=758, id=1, productName=Unmarked objects,

count=3, id=93, version=2179,

count=7, id=18, version=8444,

count=125, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=265, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=133, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=144, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=97, productName=Unmarked objects (old),

count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,