Behavioral task
behavioral1
Sample
2024-10-09_8c8e8a52bb1f079328d02bb91839c76c_backswap_icedid.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-09_8c8e8a52bb1f079328d02bb91839c76c_backswap_icedid.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-09_8c8e8a52bb1f079328d02bb91839c76c_backswap_icedid
-
Size
2.6MB
-
MD5
8c8e8a52bb1f079328d02bb91839c76c
-
SHA1
e501f56c806f05fdb7c65c8618496fc7b115e718
-
SHA256
9d7c6d8d94c42099865db20820b041324922563d350bd2caf98b62b7a7c5eaa2
-
SHA512
0f4bb00fcb24df185861a662a6439159005a25562aff5abdc0eb2ec669da829a4220bd7b433b303b2e2c168d653e2df78dc7d371d118b2320717650d0ca695e7
-
SSDEEP
24576:5nWYXDaHMv6CorjqnyPQGzh0JONZejOuC+e4mOzrvxiI3ENyesg/jHLxQVIxX6Lt:tl1vqjdPQRw/D4mizA0dizLrB51vM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule sample autoit_exe -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-10-09_8c8e8a52bb1f079328d02bb91839c76c_backswap_icedid
Files
-
2024-10-09_8c8e8a52bb1f079328d02bb91839c76c_backswap_icedid.exe windows:4 windows x86 arch:x86
9d5552b3a103c723c650b0d7a6310980
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapReAlloc
HeapFree
IsBadReadPtr
GetTickCount
CloseHandle
ReadFile
GetFileSize
FindClose
FindNextFileA
DeleteFileA
RemoveDirectoryA
FindFirstFileA
Sleep
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
HeapAlloc
FormatMessageA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
GetCurrentProcessId
TerminateProcess
OpenProcess
ExitProcess
GetModuleHandleA
CreateProcessA
MoveFileA
CreateDirectoryA
GetModuleFileNameA
CreateFileA
GetUserDefaultLCID
lstrcpyn
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
SetFilePointer
GetOEMCP
GetACP
GetCPInfo
VirtualAlloc
RaiseException
LCMapStringW
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
WriteFile
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExA
GetLastError
GetCurrentProcess
GetStartupInfoA
GetVersion
InterlockedDecrement
InterlockedIncrement
RtlUnwind
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
user32
PeekMessageA
GetMessageA
TranslateMessage
MessageBoxA
DispatchMessageA
wsprintfA
advapi32
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
CryptGetHashParam
ole32
CoUninitialize
OleRun
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoInitialize
shlwapi
PathFileExistsA
oleaut32
VariantChangeType
VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SysFreeString
VarR8FromCy
VarR8FromBool
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
SysAllocString
VariantClear
SafeArrayDestroy
SafeArrayCreate
shell32
SHGetSpecialFolderPathA
Sections
.text Size: 80KB - Virtual size: 77KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ