Analysis
-
max time kernel
128s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
19-11-2022 13:50
General
-
Target
b4d4590a582639275a82f8de43cb470da98af293b3e3d147ae66fd24b793a832.exe
-
Size
4.0MB
-
MD5
a0588d88e7ddb01fc9ac9d3b5cf215d8
-
SHA1
3647f00f21ba2f090d81f07fca5137c4566b4046
-
SHA256
b4d4590a582639275a82f8de43cb470da98af293b3e3d147ae66fd24b793a832
-
SHA512
0597a689f1b9c521415835272f123782ce5431c3049be15aa38664e8b288cf29a6715eb47e023e2479bfbba2ee387435ba72b5b7e14801a6c086b59f311df9c6
-
SSDEEP
98304:WBLaX2XjPrbVGbFWMZNA2wITWuXIu/M1vrGp1oVXL:YLaWrh3WNVwWWuz/M1vqpeXL
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 5 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 6 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4d4590a582639275a82f8de43cb470da98af293b3e3d147ae66fd24b793a832.exe"C:\Users\Admin\AppData\Local\Temp\b4d4590a582639275a82f8de43cb470da98af293b3e3d147ae66fd24b793a832.exe"1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
12.6MB
-
Filesize
12.6MB
-
Filesize
12.6MB
-
Filesize
12.6MB
-
Filesize
12.6MB