Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13/09/2024, 03:17
General
-
Target
2024-09-13_e646b8fa3328c96c9447dd31e49d718c_hacktools_hijackloader_icedid.exe
-
Size
7.1MB
-
MD5
e646b8fa3328c96c9447dd31e49d718c
-
SHA1
1c84e826cdc4d7db7805dd06dec27c6ece51892c
-
SHA256
ff888fd00a75fa191aabb9d3ffaca2d948852d8fbd2149863b099ff400ee6029
-
SHA512
20bd1357e33555e8cd26b37f8bb279818b0ffcbbf0a0f42661498b9febd31d7f95d42207d982e7f4469cc2c6502317bf870f8501186f348d39f1e394875c5585
-
SSDEEP
98304:aV3l8INGWygtmETSfAAvAF6RKy91PM+FWEnNKSiLKwESgjMxS7:UVbwgtmEOfKkKy9m+0ENKSiLKXSRE
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 4 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_e646b8fa3328c96c9447dd31e49d718c_hacktools_hijackloader_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_e646b8fa3328c96c9447dd31e49d718c_hacktools_hijackloader_icedid.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
4KB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
100KB
-
Filesize
7.5MB