Analysis
-
max time kernel
120s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
21-12-2024 01:28
General
-
Target
2024-12-21_0cf078084380fed6fd4442e48b2c444c_icedid.exe
-
Size
1.1MB
-
MD5
0cf078084380fed6fd4442e48b2c444c
-
SHA1
b495baad7740ade6c58ee1a64e40432a23aa0c94
-
SHA256
ebc62243a0a801c9966c98befa5f0a30ffaea13f30a3f705911373ac0d71b410
-
SHA512
3093261a01f796fd7dbcaf9895fa0e6cc6379ce3e5488f98e6c547ba38c46a9fa86dffe81cc357e0a19c3096bf1b88350027aac7bb509856b299296ef2930c9a
-
SSDEEP
12288:lDxjQa1iQWYkWDMZA/95zeFSqsarFossFFy2f/r2AgERqwa6mi/qION7MwQ3LkvB:lDpQa1iLYpDx/Hz01sFQSz2AghjaZ3QZ
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 4 IoCs
-
UAC bypass 3 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 7 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-21_0cf078084380fed6fd4442e48b2c444c_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-21_0cf078084380fed6fd4442e48b2c444c_icedid.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Downloads\RTVHTzgq.exeVmJzqyuQAlucxmId2⤵
- UAC bypass
- Deletes itself
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD50cf078084380fed6fd4442e48b2c444c
SHA1b495baad7740ade6c58ee1a64e40432a23aa0c94
SHA256ebc62243a0a801c9966c98befa5f0a30ffaea13f30a3f705911373ac0d71b410
SHA5123093261a01f796fd7dbcaf9895fa0e6cc6379ce3e5488f98e6c547ba38c46a9fa86dffe81cc357e0a19c3096bf1b88350027aac7bb509856b299296ef2930c9a
-
Filesize
260KB
-
Filesize
44KB
-
Filesize
260KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
260KB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
260KB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
44KB