Analysis

  • max time kernel
    132s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220721-en
  • submitted
    22-07-2022 12:14

General

  • Target

    tfccltd.exe

  • Size

    292KB

  • MD5

    a1bfff3769a3962c5075e041c1c937b3

  • SHA1

    2936ad4944f553277842155b0de2aa5f43d741fb

  • SHA256

    ae8369a28b53ba7e283436a65c211ef032af555515fb961e6cb0c56c635d1834

  • SHA512

    31eb0d602e1621b40cbc27acc85ac96eae2ab5d11d074fd13df2e08501c55bce328e75acb53ac666d4135246e018e85ac90e2a8b3099deb0d148c9e88186b7c5

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 11 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 10 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tfccltd.exe
    "C:\Users\Admin\AppData\Local\Temp\tfccltd.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2708
    • C:\Users\Admin\AppData\Local\Temp\test.exe
      C:\Users\Admin\AppData\Local\Temp/test.exe 2048&&106.126.11.167:80&&Mozilla/5.0¿Õ¸ñ(compatible;¿Õ¸ñBaiduspider-render/2.0;¿Õ¸ñ+http://www.baidu.com/search/spider.html)&&9999999&&¼Ù&&¼Ù&&¿Õ&&¿Õ
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4092
      • C:\Users\Admin\AppData\Local\Temp\test.exe
        C:\Users\Admin\AppData\Local\Temp\test.exe "1024&&106.126.11.167:80&&Mozilla/5.0????(compatible;????Baiduspider-render/2.0;????+http://www.baidu.com/search/spider.html)&&9999999&&?¨´&&?¨´&&??&&??"
        3⤵
        • Executes dropped EXE
        PID:3860
    • C:\Users\Admin\AppData\Local\Temp\test.exe
      C:\Users\Admin\AppData\Local\Temp/test.exe 2048&&106.126.11.167:80&&Mozilla/5.0¿Õ¸ñ(compatible;¿Õ¸ñBaiduspider-render/2.0;¿Õ¸ñ+http://www.baidu.com/search/spider.html)&&9999999&&¼Ù&&¼Ù&&¿Õ&&¿Õ
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3852
      • C:\Users\Admin\AppData\Local\Temp\test.exe
        C:\Users\Admin\AppData\Local\Temp\test.exe "1024&&106.126.11.167:80&&Mozilla/5.0????(compatible;????Baiduspider-render/2.0;????+http://www.baidu.com/search/spider.html)&&9999999&&?¨´&&?¨´&&??&&??"
        3⤵
        • Executes dropped EXE
        PID:4076
    • C:\Users\Admin\AppData\Local\Temp\test.exe
      C:\Users\Admin\AppData\Local\Temp/test.exe 2048&&106.126.11.167:80&&Mozilla/5.0¿Õ¸ñ(compatible;¿Õ¸ñBaiduspider-render/2.0;¿Õ¸ñ+http://www.baidu.com/search/spider.html)&&9999999&&¼Ù&&¼Ù&&¿Õ&&¿Õ
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3912
      • C:\Users\Admin\AppData\Local\Temp\test.exe
        C:\Users\Admin\AppData\Local\Temp\test.exe "1024&&106.126.11.167:80&&Mozilla/5.0????(compatible;????Baiduspider-render/2.0;????+http://www.baidu.com/search/spider.html)&&9999999&&?¨´&&?¨´&&??&&??"
        3⤵
        • Executes dropped EXE
        PID:4972
    • C:\Users\Admin\AppData\Local\Temp\test.exe
      C:\Users\Admin\AppData\Local\Temp/test.exe 2048&&106.126.11.167:80&&Mozilla/5.0¿Õ¸ñ(compatible;¿Õ¸ñBaiduspider-render/2.0;¿Õ¸ñ+http://www.baidu.com/search/spider.html)&&9999999&&¼Ù&&¼Ù&&¿Õ&&¿Õ
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4912
      • C:\Users\Admin\AppData\Local\Temp\test.exe
        C:\Users\Admin\AppData\Local\Temp\test.exe "1024&&106.126.11.167:80&&Mozilla/5.0????(compatible;????Baiduspider-render/2.0;????+http://www.baidu.com/search/spider.html)&&9999999&&?¨´&&?¨´&&??&&??"
        3⤵
        • Executes dropped EXE
        PID:448
    • C:\Users\Admin\AppData\Local\Temp\test.exe
      C:\Users\Admin\AppData\Local\Temp/test.exe 2048&&106.126.11.167:80&&Mozilla/5.0¿Õ¸ñ(compatible;¿Õ¸ñBaiduspider-render/2.0;¿Õ¸ñ+http://www.baidu.com/search/spider.html)&&9999999&&¼Ù&&¼Ù&&¿Õ&&¿Õ
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3464
      • C:\Users\Admin\AppData\Local\Temp\test.exe
        C:\Users\Admin\AppData\Local\Temp\test.exe "1024&&106.126.11.167:80&&Mozilla/5.0????(compatible;????Baiduspider-render/2.0;????+http://www.baidu.com/search/spider.html)&&9999999&&?¨´&&?¨´&&??&&??"
        3⤵
        • Executes dropped EXE
        PID:3044
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /im test.exe /f
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:44452

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\test.exe

    Filesize

    102KB

    MD5

    6dffe4f58e220cd779b530478e9a40a0

    SHA1

    6def979cb57b7a4fa97b87f3c0e0b02a37c17c85

    SHA256

    d952722ac595dc3f86d0307092ed7adca701edf8d568984dc479fbf10d4a6348

    SHA512

    c5a18b0cbffe08b45c9534515be3f232f0d0861954d79ee80a14f382f748852f124aaa78927988e06347f531c87ce71ddbd793b8ddd422bff8756096041d4973

  • C:\Users\Admin\AppData\Local\Temp\test.exe

    Filesize

    102KB

    MD5

    6dffe4f58e220cd779b530478e9a40a0

    SHA1

    6def979cb57b7a4fa97b87f3c0e0b02a37c17c85

    SHA256

    d952722ac595dc3f86d0307092ed7adca701edf8d568984dc479fbf10d4a6348

    SHA512

    c5a18b0cbffe08b45c9534515be3f232f0d0861954d79ee80a14f382f748852f124aaa78927988e06347f531c87ce71ddbd793b8ddd422bff8756096041d4973

  • C:\Users\Admin\AppData\Local\Temp\test.exe

    Filesize

    102KB

    MD5

    6dffe4f58e220cd779b530478e9a40a0

    SHA1

    6def979cb57b7a4fa97b87f3c0e0b02a37c17c85

    SHA256

    d952722ac595dc3f86d0307092ed7adca701edf8d568984dc479fbf10d4a6348

    SHA512

    c5a18b0cbffe08b45c9534515be3f232f0d0861954d79ee80a14f382f748852f124aaa78927988e06347f531c87ce71ddbd793b8ddd422bff8756096041d4973

  • C:\Users\Admin\AppData\Local\Temp\test.exe

    Filesize

    102KB

    MD5

    6dffe4f58e220cd779b530478e9a40a0

    SHA1

    6def979cb57b7a4fa97b87f3c0e0b02a37c17c85

    SHA256

    d952722ac595dc3f86d0307092ed7adca701edf8d568984dc479fbf10d4a6348

    SHA512

    c5a18b0cbffe08b45c9534515be3f232f0d0861954d79ee80a14f382f748852f124aaa78927988e06347f531c87ce71ddbd793b8ddd422bff8756096041d4973

  • C:\Users\Admin\AppData\Local\Temp\test.exe

    Filesize

    102KB

    MD5

    6dffe4f58e220cd779b530478e9a40a0

    SHA1

    6def979cb57b7a4fa97b87f3c0e0b02a37c17c85

    SHA256

    d952722ac595dc3f86d0307092ed7adca701edf8d568984dc479fbf10d4a6348

    SHA512

    c5a18b0cbffe08b45c9534515be3f232f0d0861954d79ee80a14f382f748852f124aaa78927988e06347f531c87ce71ddbd793b8ddd422bff8756096041d4973

  • C:\Users\Admin\AppData\Local\Temp\test.exe

    Filesize

    102KB

    MD5

    6dffe4f58e220cd779b530478e9a40a0

    SHA1

    6def979cb57b7a4fa97b87f3c0e0b02a37c17c85

    SHA256

    d952722ac595dc3f86d0307092ed7adca701edf8d568984dc479fbf10d4a6348

    SHA512

    c5a18b0cbffe08b45c9534515be3f232f0d0861954d79ee80a14f382f748852f124aaa78927988e06347f531c87ce71ddbd793b8ddd422bff8756096041d4973

  • C:\Users\Admin\AppData\Local\Temp\test.exe

    Filesize

    102KB

    MD5

    6dffe4f58e220cd779b530478e9a40a0

    SHA1

    6def979cb57b7a4fa97b87f3c0e0b02a37c17c85

    SHA256

    d952722ac595dc3f86d0307092ed7adca701edf8d568984dc479fbf10d4a6348

    SHA512

    c5a18b0cbffe08b45c9534515be3f232f0d0861954d79ee80a14f382f748852f124aaa78927988e06347f531c87ce71ddbd793b8ddd422bff8756096041d4973

  • C:\Users\Admin\AppData\Local\Temp\test.exe

    Filesize

    102KB

    MD5

    6dffe4f58e220cd779b530478e9a40a0

    SHA1

    6def979cb57b7a4fa97b87f3c0e0b02a37c17c85

    SHA256

    d952722ac595dc3f86d0307092ed7adca701edf8d568984dc479fbf10d4a6348

    SHA512

    c5a18b0cbffe08b45c9534515be3f232f0d0861954d79ee80a14f382f748852f124aaa78927988e06347f531c87ce71ddbd793b8ddd422bff8756096041d4973

  • C:\Users\Admin\AppData\Local\Temp\test.exe

    Filesize

    102KB

    MD5

    6dffe4f58e220cd779b530478e9a40a0

    SHA1

    6def979cb57b7a4fa97b87f3c0e0b02a37c17c85

    SHA256

    d952722ac595dc3f86d0307092ed7adca701edf8d568984dc479fbf10d4a6348

    SHA512

    c5a18b0cbffe08b45c9534515be3f232f0d0861954d79ee80a14f382f748852f124aaa78927988e06347f531c87ce71ddbd793b8ddd422bff8756096041d4973

  • C:\Users\Admin\AppData\Local\Temp\test.exe

    Filesize

    102KB

    MD5

    6dffe4f58e220cd779b530478e9a40a0

    SHA1

    6def979cb57b7a4fa97b87f3c0e0b02a37c17c85

    SHA256

    d952722ac595dc3f86d0307092ed7adca701edf8d568984dc479fbf10d4a6348

    SHA512

    c5a18b0cbffe08b45c9534515be3f232f0d0861954d79ee80a14f382f748852f124aaa78927988e06347f531c87ce71ddbd793b8ddd422bff8756096041d4973

  • C:\Users\Admin\AppData\Local\Temp\test.exe

    Filesize

    102KB

    MD5

    6dffe4f58e220cd779b530478e9a40a0

    SHA1

    6def979cb57b7a4fa97b87f3c0e0b02a37c17c85

    SHA256

    d952722ac595dc3f86d0307092ed7adca701edf8d568984dc479fbf10d4a6348

    SHA512

    c5a18b0cbffe08b45c9534515be3f232f0d0861954d79ee80a14f382f748852f124aaa78927988e06347f531c87ce71ddbd793b8ddd422bff8756096041d4973

  • memory/448-143-0x0000000000000000-mapping.dmp

  • memory/3044-144-0x0000000000000000-mapping.dmp

  • memory/3464-130-0x0000000000000000-mapping.dmp

  • memory/3852-132-0x0000000000000000-mapping.dmp

  • memory/3860-141-0x0000000000000000-mapping.dmp

  • memory/3912-133-0x0000000000000000-mapping.dmp

  • memory/4076-149-0x0000000000000000-mapping.dmp

  • memory/4092-134-0x0000000000000000-mapping.dmp

  • memory/4912-131-0x0000000000000000-mapping.dmp

  • memory/4972-142-0x0000000000000000-mapping.dmp

  • memory/44452-151-0x0000000000000000-mapping.dmp