Analysis
-
max time kernel
136s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
27-07-2024 10:24
General
-
Target
2024-07-27_100cecb81c478339a93cfbe9cf0e6806_icedid_magniber_sakula.exe
-
Size
23.6MB
-
MD5
100cecb81c478339a93cfbe9cf0e6806
-
SHA1
593671c9abfae05961ed46699ebfc6b64e5e58c3
-
SHA256
65b4ddefe546f5b1dc10d748023b65c8456900eaa9f6d9aa6e117687770ad819
-
SHA512
c35e2349c10afbbc198329ba1f341b712d6b921d5013f1fe3c5cdedb2d69ed3ae369a9ae76c4affe6d4feb35e515b4c147553673ab5d182b51befde1f8d2bdb9
-
SSDEEP
393216:Gsq0rJE1XDrpe9Z+0LA6gDK1ocW1+7aXDC9MgFO0ck70fVPnxVSOyrnOviWcuEw/:G/wadDE9EkEmoX1MAOmgFH0fVPnxVSOx
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 6 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Drops startup file 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 44 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-27_100cecb81c478339a93cfbe9cf0e6806_icedid_magniber_sakula.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-27_100cecb81c478339a93cfbe9cf0e6806_icedid_magniber_sakula.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\Tomcat.exe"C:\Users\Admin\Documents\Tomcat.exe"2⤵
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148KB
MD5051d69a619adca3472e8d7c9b0c0eb5c
SHA16cc795ac90e43e408919e19ba6f5633863560459
SHA256feefc12464985e2057a4cbd54117e9414f2e00a284106fa38b62d63052a1f7dd
SHA51250daa3344aa4d86cdd22cf5736eec993467e6574c5e341cd0fd95757c739e167b6e76c744b29ae302d08c88d469fea0767640a9257f54f9dec2c5fbb87c23b71
-
Filesize
2.1MB
MD5e1e3c124ce8481e2a35e49eb94ae59c2
SHA1c9dce6860e4c645ef40b26578f778d018399947c
SHA2566d67495ced5afc1ef0720b08801c8f0e6c5daa1effcc1f26a4cf56a55980df7c
SHA5121669786e35abd0c17b8c1ddfd0cea29bb80aead0d07ab7a26c7f7d8a7768111ac6129006d52090a1939a26cc84f33f683e1496f4afcb16353354241f71d903d5
-
Filesize
226B
MD5d6c58c52bca94d6a572ec967ba79e9cd
SHA10ff419bae9b81d04b841b8eafeb672d7090f09cc
SHA256b3eb0fd3a901f8054310b99dd1ae59e26acc81a33b67e744b4939345d35d3f18
SHA51262267d2e419ab1a0a2f19252da3554afbd6ddbd469a59de15d66d8adad4a3b1607ab76c809f5e942032309d58d998aa1dd4515dd25195fa0d1cff20b52a71853
-
Filesize
4KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
356KB
-
Filesize
96KB
-
Filesize
2.2MB
-
Filesize
1.0MB
-
Filesize
2.2MB
-
Filesize
2.2MB