Analysis
-
max time kernel
136s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2024 10:24
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-27_100cecb81c478339a93cfbe9cf0e6806_icedid_magniber_sakula.exe
Resource
win7-20240708-en
General
-
Target
2024-07-27_100cecb81c478339a93cfbe9cf0e6806_icedid_magniber_sakula.exe
-
Size
23.6MB
-
MD5
100cecb81c478339a93cfbe9cf0e6806
-
SHA1
593671c9abfae05961ed46699ebfc6b64e5e58c3
-
SHA256
65b4ddefe546f5b1dc10d748023b65c8456900eaa9f6d9aa6e117687770ad819
-
SHA512
c35e2349c10afbbc198329ba1f341b712d6b921d5013f1fe3c5cdedb2d69ed3ae369a9ae76c4affe6d4feb35e515b4c147553673ab5d182b51befde1f8d2bdb9
-
SSDEEP
393216:Gsq0rJE1XDrpe9Z+0LA6gDK1ocW1+7aXDC9MgFO0ck70fVPnxVSOyrnOviWcuEw/:G/wadDE9EkEmoX1MAOmgFH0fVPnxVSOx
Malware Config
Signatures
-
Detect Blackmoon payload 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\Documents\Tomcat.exe family_blackmoon behavioral2/memory/2016-27-0x0000000000750000-0x000000000098A000-memory.dmp family_blackmoon behavioral2/memory/2016-28-0x0000000000750000-0x000000000098A000-memory.dmp family_blackmoon behavioral2/memory/2016-20-0x0000000000750000-0x000000000098A000-memory.dmp family_blackmoon behavioral2/memory/2016-31-0x0000000000750000-0x000000000098A000-memory.dmp family_blackmoon behavioral2/memory/2016-32-0x0000000000750000-0x000000000098A000-memory.dmp family_blackmoon -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-07-27_100cecb81c478339a93cfbe9cf0e6806_icedid_magniber_sakula.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation 2024-07-27_100cecb81c478339a93cfbe9cf0e6806_icedid_magniber_sakula.exe -
Deletes itself 1 IoCs
Processes:
Tomcat.exepid process 2016 Tomcat.exe -
Drops startup file 1 IoCs
Processes:
Tomcat.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WPS.lnk Tomcat.exe -
Executes dropped EXE 1 IoCs
Processes:
Tomcat.exepid process 2016 Tomcat.exe -
Loads dropped DLL 1 IoCs
Processes:
Tomcat.exepid process 2016 Tomcat.exe -
Processes:
resource yara_rule behavioral2/memory/2016-25-0x0000000003040000-0x0000000003058000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
2024-07-27_100cecb81c478339a93cfbe9cf0e6806_icedid_magniber_sakula.exeTomcat.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-07-27_100cecb81c478339a93cfbe9cf0e6806_icedid_magniber_sakula.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Tomcat.exe -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
2024-07-27_100cecb81c478339a93cfbe9cf0e6806_icedid_magniber_sakula.exeTomcat.exepid process 4956 2024-07-27_100cecb81c478339a93cfbe9cf0e6806_icedid_magniber_sakula.exe 4956 2024-07-27_100cecb81c478339a93cfbe9cf0e6806_icedid_magniber_sakula.exe 4956 2024-07-27_100cecb81c478339a93cfbe9cf0e6806_icedid_magniber_sakula.exe 4956 2024-07-27_100cecb81c478339a93cfbe9cf0e6806_icedid_magniber_sakula.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe 2016 Tomcat.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
Tomcat.exedescription pid process Token: SeDebugPrivilege 2016 Tomcat.exe Token: SeLockMemoryPrivilege 2016 Tomcat.exe Token: SeCreateGlobalPrivilege 2016 Tomcat.exe Token: SeBackupPrivilege 2016 Tomcat.exe Token: SeRestorePrivilege 2016 Tomcat.exe Token: SeShutdownPrivilege 2016 Tomcat.exe Token: SeCreateTokenPrivilege 2016 Tomcat.exe Token: SeTakeOwnershipPrivilege 2016 Tomcat.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2024-07-27_100cecb81c478339a93cfbe9cf0e6806_icedid_magniber_sakula.exepid process 4956 2024-07-27_100cecb81c478339a93cfbe9cf0e6806_icedid_magniber_sakula.exe 4956 2024-07-27_100cecb81c478339a93cfbe9cf0e6806_icedid_magniber_sakula.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-07-27_100cecb81c478339a93cfbe9cf0e6806_icedid_magniber_sakula.exedescription pid process target process PID 4956 wrote to memory of 2016 4956 2024-07-27_100cecb81c478339a93cfbe9cf0e6806_icedid_magniber_sakula.exe Tomcat.exe PID 4956 wrote to memory of 2016 4956 2024-07-27_100cecb81c478339a93cfbe9cf0e6806_icedid_magniber_sakula.exe Tomcat.exe PID 4956 wrote to memory of 2016 4956 2024-07-27_100cecb81c478339a93cfbe9cf0e6806_icedid_magniber_sakula.exe Tomcat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-27_100cecb81c478339a93cfbe9cf0e6806_icedid_magniber_sakula.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-27_100cecb81c478339a93cfbe9cf0e6806_icedid_magniber_sakula.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\Documents\Tomcat.exe"C:\Users\Admin\Documents\Tomcat.exe"2⤵
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2016
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148KB
MD5051d69a619adca3472e8d7c9b0c0eb5c
SHA16cc795ac90e43e408919e19ba6f5633863560459
SHA256feefc12464985e2057a4cbd54117e9414f2e00a284106fa38b62d63052a1f7dd
SHA51250daa3344aa4d86cdd22cf5736eec993467e6574c5e341cd0fd95757c739e167b6e76c744b29ae302d08c88d469fea0767640a9257f54f9dec2c5fbb87c23b71
-
Filesize
2.1MB
MD5e1e3c124ce8481e2a35e49eb94ae59c2
SHA1c9dce6860e4c645ef40b26578f778d018399947c
SHA2566d67495ced5afc1ef0720b08801c8f0e6c5daa1effcc1f26a4cf56a55980df7c
SHA5121669786e35abd0c17b8c1ddfd0cea29bb80aead0d07ab7a26c7f7d8a7768111ac6129006d52090a1939a26cc84f33f683e1496f4afcb16353354241f71d903d5
-
Filesize
226B
MD5d6c58c52bca94d6a572ec967ba79e9cd
SHA10ff419bae9b81d04b841b8eafeb672d7090f09cc
SHA256b3eb0fd3a901f8054310b99dd1ae59e26acc81a33b67e744b4939345d35d3f18
SHA51262267d2e419ab1a0a2f19252da3554afbd6ddbd469a59de15d66d8adad4a3b1607ab76c809f5e942032309d58d998aa1dd4515dd25195fa0d1cff20b52a71853