Overview

overview

10

Static

static

8

cb6111ad06...ed.exe

windows7-x64

10

cb6111ad06...ed.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    87s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/11/2022, 19:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    cb6111ad06c056423fa7c8cf921b95c6986c7f54bdf9a609441d30025e26ffed.exe

  • Size

    4.0MB

  • MD5

    d95bc0e174ee7a1edddcfba52469cee2

  • SHA1

    e2a0ead877ce762bfa57f4317e07342c69076a1d

  • SHA256

    cb6111ad06c056423fa7c8cf921b95c6986c7f54bdf9a609441d30025e26ffed

  • SHA512

    47ebdb24679f2ea695159ace65bc61ee6303140da20127d3e082c5831ab869c6d5e9929d004c8b8257fb446526a937c07b6f8ae434c450c1f46ef6a362d4f374

  • SSDEEP

    98304:tJgug67CrzpFObJV0ypLd6r+DxnSQpCtlbvV0TAYP/RIBaQFIlxW0z:fgQ72cE8tDxnDpEbvVwAe/GDOlrz

Score
10/10
blackmoonjokerbankerinfostealertrojanupx

Malware Config

Extracted

Family

joker

C2

https://htuzi.oss-cn-shanghai.aliyuncs.com

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon
  • Detect Blackmoon payload 4 IoCs
  • joker

    Joker is an Android malware that targets billing and SMS fraud.

    infostealertrojanjoker
  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb6111ad06c056423fa7c8cf921b95c6986c7f54bdf9a609441d30025e26ffed.exe
    "C:\Users\Admin\AppData\Local\Temp\cb6111ad06c056423fa7c8cf921b95c6986c7f54bdf9a609441d30025e26ffed.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3400
    • C:\Users\Admin\AppData\Local\Temp\tuzi_nsudo\NSudo.exe
      "C:\Users\Admin\AppData\Local\Temp\tuzi_nsudo\NSudo.exe" -U:S "C:\Users\Admin\AppData\Local\Temp\cb6111ad06c056423fa7c8cf921b95c6986c7f54bdf9a609441d30025e26ffed.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3672

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\tuzi_nsudo\NSudo.exe
          Filesize

          247KB

          MD5

          5cae01aea8ed390ce9bec17b6c1237e4

          SHA1

          3a80a49efaac5d839400e4fb8f803243fb39a513

          SHA256

          19896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618

          SHA512

          c8e54c92133ba686238ea554c1cd82ba441db5fd4b0cbd5082d5eb4ddfcedd15506b9dac553459d0b2221c75778241f926ed3eef64571e4b1e0eb6f80ff9b481

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\tuzi_nsudo\NSudo.json
          Filesize

          211B

          MD5

          922322fab45a284dbb248760125dfb1c

          SHA1

          120e77b90baa85287b2ee5bc63ff7dcd149767b5

          SHA256

          254beac232a7bb20289b0608db5a0ccc69789fb8befe2bf3c76fa09953eea6f5

          SHA512

          899dc404559518e311343a0a71ef4f88e4820268ff821082400660647259594cb1a088359c75b17f4e0df85ea5ad91e49b3e86f636e95955c2c56f1e667f4aaf

          Download Submit

        • memory/3400-132-0x0000000000400000-0x0000000001092000-memory.dmp

          Filesize

          12.6MB

          Download

        • memory/3400-133-0x0000000000400000-0x0000000001092000-memory.dmp

          Filesize

          12.6MB

          Download

        • memory/3400-134-0x0000000000400000-0x0000000001092000-memory.dmp

          Filesize

          12.6MB

          Download

        • memory/3400-135-0x0000000000400000-0x0000000001092000-memory.dmp

          Filesize

          12.6MB

          Download

        • memory/3400-136-0x0000000010000000-0x00000000100BE000-memory.dmp

          Filesize

          760KB

          Download

        • memory/3400-138-0x0000000010000000-0x00000000100BE000-memory.dmp

          Filesize

          760KB

          Download

        • memory/3400-139-0x0000000010000000-0x00000000100BE000-memory.dmp

          Filesize

          760KB

          Download

        • memory/3400-140-0x0000000010000000-0x00000000100BE000-memory.dmp

          Filesize

          760KB

          Download

        • memory/3400-144-0x0000000000400000-0x0000000001092000-memory.dmp

          Filesize

          12.6MB

          Download