Malware Analysis Report

2024-11-16 13:58

Sample ID 240620-qbav7syeqc
Target 2024-06-20_30c9bffeef7c5598279030e7e5675547_icedid_magniber_sakula
SHA256 6dda09e05bb1bed63f13b5d5d34fa8acae55e45ed25da06cf2ca1d20152fad2f
Tags
blackmoon banker discovery trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6dda09e05bb1bed63f13b5d5d34fa8acae55e45ed25da06cf2ca1d20152fad2f

Threat Level: Known bad

The file 2024-06-20_30c9bffeef7c5598279030e7e5675547_icedid_magniber_sakula was found to be: Known bad.

Malicious Activity Summary

blackmoon banker discovery trojan upx

Detect Blackmoon payload

Blackmoon, KrBanker

UPX dump on OEP (original entry point)

UPX dump on OEP (original entry point)

Drops startup file

Deletes itself

UPX packed file

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Checks installed software on the system

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-20 13:04

Signatures

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 13:04

Reported

2024-06-20 13:07

Platform

win7-20240221-en

Max time kernel

122s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-20_30c9bffeef7c5598279030e7e5675547_icedid_magniber_sakula.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WPS.lnk C:\Users\Admin\Documents\Tomcat.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-20_30c9bffeef7c5598279030e7e5675547_icedid_magniber_sakula.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-20_30c9bffeef7c5598279030e7e5675547_icedid_magniber_sakula.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\Documents\Tomcat.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\Documents\Tomcat.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\Documents\Tomcat.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Documents\Tomcat.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Documents\Tomcat.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Documents\Tomcat.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\Documents\Tomcat.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\Documents\Tomcat.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-20_30c9bffeef7c5598279030e7e5675547_icedid_magniber_sakula.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-20_30c9bffeef7c5598279030e7e5675547_icedid_magniber_sakula.exe"

C:\Users\Admin\Documents\Tomcat.exe

"C:\Users\Admin\Documents\Tomcat.exe"

Network

Country Destination Domain Proto
HK 206.233.128.109:3760 tcp

Files

memory/2944-1-0x0000000010000000-0x0000000010014000-memory.dmp

\Users\Admin\Documents\Tomcat.exe

MD5 3f71703f4d6db77023f777c773d17199
SHA1 0299f4b32363bb3882fcc37022b8d83b99d15c88
SHA256 7f8b61e91350ec2fb7967dc1a333ab7ee00e7b96945b124320571c4c8b4cae4b
SHA512 15c601841fce6d175ead0c4006495697a9469dc631a58bee9515e3f79bbd54244d2fcb555514ae522fab2524a6484c735391590c5a30bb8a1b7526636520d93a

memory/2096-11-0x0000000010000000-0x0000000010109000-memory.dmp

memory/2096-17-0x0000000000070000-0x0000000000088000-memory.dmp

memory/2096-18-0x00000000021B0000-0x0000000002209000-memory.dmp

C:\Users\Admin\Documents\conf.ini

MD5 5e4b78d3d5a0940d60e45f81cc68fafa
SHA1 4534f7904fc270328ee0369b605b7f0bc3654e70
SHA256 fe6dd28f9acdf78b8e4d01be1b1737bf63683d6a788336696196552e8eccdf3b
SHA512 9176b6d2b5cee9950aa8301028e5130fd24b3b3c459a67358a21335a7b68733bc104ffa2996b08b13cb22e2d497bd895f7f21ad03a17411743865d17ff379d6d

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 13:04

Reported

2024-06-20 13:07

Platform

win10v2004-20240508-en

Max time kernel

133s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-20_30c9bffeef7c5598279030e7e5675547_icedid_magniber_sakula.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2024-06-20_30c9bffeef7c5598279030e7e5675547_icedid_magniber_sakula.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WPS.lnk C:\Users\Admin\Documents\Tomcat.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-20_30c9bffeef7c5598279030e7e5675547_icedid_magniber_sakula.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-20_30c9bffeef7c5598279030e7e5675547_icedid_magniber_sakula.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-20_30c9bffeef7c5598279030e7e5675547_icedid_magniber_sakula.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-20_30c9bffeef7c5598279030e7e5675547_icedid_magniber_sakula.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A
N/A N/A C:\Users\Admin\Documents\Tomcat.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\Documents\Tomcat.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\Documents\Tomcat.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\Documents\Tomcat.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Documents\Tomcat.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Documents\Tomcat.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Documents\Tomcat.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\Documents\Tomcat.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\Documents\Tomcat.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-20_30c9bffeef7c5598279030e7e5675547_icedid_magniber_sakula.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-20_30c9bffeef7c5598279030e7e5675547_icedid_magniber_sakula.exe"

C:\Users\Admin\Documents\Tomcat.exe

"C:\Users\Admin\Documents\Tomcat.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
HK 206.233.128.109:3760 tcp
HK 206.233.128.109:3760 tcp
HK 206.233.128.109:3760 tcp
HK 206.233.128.109:3760 tcp
HK 206.233.128.109:3760 tcp
HK 206.233.128.109:3760 tcp
HK 206.233.128.109:3760 tcp

Files

memory/3956-1-0x0000000007AA0000-0x0000000007AC7000-memory.dmp

memory/3956-2-0x0000000010000000-0x0000000010014000-memory.dmp

memory/3956-3-0x0000000010000000-0x0000000010014000-memory.dmp

C:\Users\Admin\Documents\Tomcat.exe

MD5 3f71703f4d6db77023f777c773d17199
SHA1 0299f4b32363bb3882fcc37022b8d83b99d15c88
SHA256 7f8b61e91350ec2fb7967dc1a333ab7ee00e7b96945b124320571c4c8b4cae4b
SHA512 15c601841fce6d175ead0c4006495697a9469dc631a58bee9515e3f79bbd54244d2fcb555514ae522fab2524a6484c735391590c5a30bb8a1b7526636520d93a

memory/548-12-0x0000000010000000-0x0000000010109000-memory.dmp

memory/548-20-0x0000000000AED000-0x0000000000AEE000-memory.dmp

memory/548-21-0x0000000000AA0000-0x0000000000C4D000-memory.dmp

C:\Users\Admin\Documents\conf.ini

MD5 5e4b78d3d5a0940d60e45f81cc68fafa
SHA1 4534f7904fc270328ee0369b605b7f0bc3654e70
SHA256 fe6dd28f9acdf78b8e4d01be1b1737bf63683d6a788336696196552e8eccdf3b
SHA512 9176b6d2b5cee9950aa8301028e5130fd24b3b3c459a67358a21335a7b68733bc104ffa2996b08b13cb22e2d497bd895f7f21ad03a17411743865d17ff379d6d

memory/548-18-0x0000000000CD0000-0x0000000000CE8000-memory.dmp

memory/548-22-0x0000000002CA0000-0x0000000002CF9000-memory.dmp

memory/548-24-0x0000000002CA0000-0x0000000002CF9000-memory.dmp

memory/548-25-0x0000000002CA0000-0x0000000002CF9000-memory.dmp

memory/548-26-0x0000000000AA0000-0x0000000000C4D000-memory.dmp

memory/548-28-0x0000000002CA0000-0x0000000002CF9000-memory.dmp

memory/548-29-0x0000000002CA0000-0x0000000002CF9000-memory.dmp

memory/548-30-0x0000000002CA0000-0x0000000002CF9000-memory.dmp

memory/548-31-0x0000000002CA0000-0x0000000002CF9000-memory.dmp

memory/548-32-0x0000000002CA0000-0x0000000002CF9000-memory.dmp

memory/548-33-0x0000000002CA0000-0x0000000002CF9000-memory.dmp

memory/548-34-0x0000000002CA0000-0x0000000002CF9000-memory.dmp

memory/548-35-0x0000000002CA0000-0x0000000002CF9000-memory.dmp

memory/548-36-0x0000000002CA0000-0x0000000002CF9000-memory.dmp

memory/548-37-0x0000000002CA0000-0x0000000002CF9000-memory.dmp