Analysis
-
max time kernel
137s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
09-08-2024 16:30
General
-
Target
2024-08-09_9cdbbd421baf739cc3b18ce01b205f1b_hijackloader_icedid.exe
-
Size
1010KB
-
MD5
9cdbbd421baf739cc3b18ce01b205f1b
-
SHA1
5de3875d2d5af2331c13f8b39a8d873f06ed492f
-
SHA256
b9ec0d3d5bd2b04214180cf75e09e2a28073f0ef465b663df1fa6dbd63c473d4
-
SHA512
0ee7dfc5832663339d81ce1b3bbcd8468c4ecd4c0f39f615faffb08fba7da139b7f174565bdb40bc231c9932fe58fedca2e37158709da28c2aaad3cb4328e7a7
-
SSDEEP
24576:F2JkWIKaPYgLICy7P30MMhoxLgbci/udwc:sArLA30TScbclw
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 5 IoCs
-
Executes dropped EXE 2 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-09_9cdbbd421baf739cc3b18ce01b205f1b_hijackloader_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-09_9cdbbd421baf739cc3b18ce01b205f1b_hijackloader_icedid.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Downloads\TuRLyEmFro.exewoKZHwwE GdVLIMwrEmFwTqfZ2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Downloads\TuRLyEmFro.exeyEPpSwLs UOxwaWwZ NnyzGoLE3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1010KB
MD59cdbbd421baf739cc3b18ce01b205f1b
SHA15de3875d2d5af2331c13f8b39a8d873f06ed492f
SHA256b9ec0d3d5bd2b04214180cf75e09e2a28073f0ef465b663df1fa6dbd63c473d4
SHA5120ee7dfc5832663339d81ce1b3bbcd8468c4ecd4c0f39f615faffb08fba7da139b7f174565bdb40bc231c9932fe58fedca2e37158709da28c2aaad3cb4328e7a7
-
Filesize
192KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
192KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
44KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB