Malware Analysis Report

2024-11-16 13:51

Sample ID 240620-fn4zpsvcpj
Target 2024-06-20_11b7634388d813788636ab9fa72a21cf_hacktools_icedid
SHA256 22b72b26d1530cf39cb3a39dc49ec3215c26b987692d01e62d79629f63831df6
Tags
blackmoon banker persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

22b72b26d1530cf39cb3a39dc49ec3215c26b987692d01e62d79629f63831df6

Threat Level: Known bad

The file 2024-06-20_11b7634388d813788636ab9fa72a21cf_hacktools_icedid was found to be: Known bad.

Malicious Activity Summary

blackmoon banker persistence trojan

Blackmoon family

Blackmoon, KrBanker

Detect Blackmoon payload

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Unsigned PE

Enumerates physical storage devices

Modifies Internet Explorer start page

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-20 05:02

Signatures

Blackmoon family

blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 05:02

Reported

2024-06-20 05:04

Platform

win7-20240508-en

Max time kernel

150s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-20_11b7634388d813788636ab9fa72a21cf_hacktools_icedid.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\½ûÖ¹ºó¿ÉÄÜ»áÑÏÖØÓ°ÏìϵͳµÄÎȶ¨ÐÔ£¬½¨Òé²»Òª½ûÖ¹£¡ = "C:\\Users\\Admin\\AppData\\Roaming\\Áè¸ç¸¨Öú\\QQSetupEx.exe" C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A

Modifies Internet Explorer start page

stealer
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?k59918823" C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-20_11b7634388d813788636ab9fa72a21cf_hacktools_icedid.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-20_11b7634388d813788636ab9fa72a21cf_hacktools_icedid.exe"

C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe

C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe

Network

N/A

Files

\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe

MD5 0e9910b495a8f2e16d6346185a78b481
SHA1 86638ebecb491909383e76bfb42a1ee454ff4c7d
SHA256 3555e84d7ae491ac0b2b12f96a53dbec119e9eeb23aacaa3bf44edb838f87ac5
SHA512 8784fba924cde19fa15c563e3785eef3a86f2695066c0a989897bd20ab62021a75ce32ed862e22e0323013b83d0a43de875eb84e50d5aeec4e87d0a1c37999f6

C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\dlcore.dll

MD5 6847e6db166c670358f6e44e4a93916a
SHA1 43f66b7700b86fe9e7a8248e8aed983e2abe3191
SHA256 e0f01280a751bc1e5dfdc14594bf2311e5d54eec64cb67ffc527303729528373
SHA512 ab4930ca123cf62ffe7d360d9cd658730a36e6146094d2b737bcb436dbb5d9b3dac60d839e7e504bca8e06559661e0ee79f977c4f5852906e83e576d2455b34b

C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

MD5 47ac2e41e42dc9b783f3bdf3434f0520
SHA1 c859633a7de2653ee7b1de57a0d817238710ab22
SHA256 76858f49341ed80a31bf645554ed488d721b0de6e5048722dfcb0bd6a1687732
SHA512 8e8494985f25f476eb45fa3e0dd0dbc2de6b08420c92119a51a5cb4e35c7bfd4f683bc308cdcc229ff1c0ddfae1ea05724ab152894f903b47411978934f1495a

C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk

MD5 dc0e024900a7c1fba2ff218f2da151ce
SHA1 c9bbc65c193e7d9fb791cd9993c14d7e3508d892
SHA256 881ef5385e3e871480731b870e5d939e1624de4e494e74844f1f4c576496ca7e
SHA512 35d530d74ee26aaaa4efb97428e05e0801420e3d60744a8f55473fb1d6d7f40ca98e469cd6368299cb3687f5151b2130ab5fdd1e5287a6e6aa252d1b6c24e976

C:\Users\Admin\Desktop\Internet Explorer.lnk

MD5 b64a35488476e60e0fcd76a807e12386
SHA1 8b5e7b63463faba54d61c4b669a6276a7c76d604
SHA256 46c00adb5bb194bb14d24620274fa70cb5a8af973fb34304ce23adf6aa56fe08
SHA512 86599a0c286b71d81d8d06e725fd4008cefbd0f39705c189ae5c61c40561aa9f07ee0c244b91b2f6a1e38f20b032ee2e6a60a3567216d8b9767a3e71885ae7cb

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

MD5 d811296cd1e0818bd73c2cb5cbc38f91
SHA1 c846f1397210432b39e6ecf177622a3210b02447
SHA256 7bcb0b4803f99e9e2a4628100cad7b31c30aa88827480da5c9e3125e5120360d
SHA512 8177c585ed82015d6e78699cd0cbce8f8b1e60899562c0bac3df65bf7d654cefbf574116509b0888a3ebfb4f1e9cb4e5668c19d01c927d7cab310a601bb5e905

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 05:02

Reported

2024-06-20 05:04

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-20_11b7634388d813788636ab9fa72a21cf_hacktools_icedid.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\½ûÖ¹ºó¿ÉÄÜ»áÑÏÖØÓ°ÏìϵͳµÄÎȶ¨ÐÔ£¬½¨Òé²»Òª½ûÖ¹£¡ = "C:\\Users\\Admin\\AppData\\Roaming\\Áè¸ç¸¨Öú\\QQSetupEx.exe" C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A

Modifies Internet Explorer start page

stealer
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?k59918823" C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-20_11b7634388d813788636ab9fa72a21cf_hacktools_icedid.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-20_11b7634388d813788636ab9fa72a21cf_hacktools_icedid.exe"

C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe

C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\QQSetupEx.exe

MD5 0e9910b495a8f2e16d6346185a78b481
SHA1 86638ebecb491909383e76bfb42a1ee454ff4c7d
SHA256 3555e84d7ae491ac0b2b12f96a53dbec119e9eeb23aacaa3bf44edb838f87ac5
SHA512 8784fba924cde19fa15c563e3785eef3a86f2695066c0a989897bd20ab62021a75ce32ed862e22e0323013b83d0a43de875eb84e50d5aeec4e87d0a1c37999f6

C:\Users\Admin\AppData\Roaming\Áè¸ç¸¨Öú\dlcore.dll

MD5 6847e6db166c670358f6e44e4a93916a
SHA1 43f66b7700b86fe9e7a8248e8aed983e2abe3191
SHA256 e0f01280a751bc1e5dfdc14594bf2311e5d54eec64cb67ffc527303729528373
SHA512 ab4930ca123cf62ffe7d360d9cd658730a36e6146094d2b737bcb436dbb5d9b3dac60d839e7e504bca8e06559661e0ee79f977c4f5852906e83e576d2455b34b

C:\Users\Admin\Desktop\Internet Explorer.lnk

MD5 00970b4f5f9d50b702aec63f4a755274
SHA1 d2b9c1dc56fd8ed935295d4eab1b0c4c0183b4b2
SHA256 fb582fcd087aeeae13cebf3967cfe9a227403f7dc84da5cd611f2613c61b7079
SHA512 ea1a8ec01f4509465d4cc2703e9d90805b4a9df81980ca1ebcb5c77f0b0e554eaf11c2b2626df950de658b2285572dddd8c9d7cc0f4dc495133270ad1450d47e