Analysis
-
max time kernel
135s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23-11-2022 06:33
General
-
Target
c9ca41e6edbf02d6c21e3a9f6da999202e2c5f60e3e72987ff81e18c1f9a70fe.exe
-
Size
2.8MB
-
MD5
459cdd6b403447d25ce3ef40200610e3
-
SHA1
808e97855171eaebea3ea15c23c036a210f71360
-
SHA256
c9ca41e6edbf02d6c21e3a9f6da999202e2c5f60e3e72987ff81e18c1f9a70fe
-
SHA512
7792dd355c394bda6a0b294959e6feacd516183c9b261829370d45a6f628c39e39cf13d0dcbffdef37225608855c4253ebe64e8727e137c0ccab771adcb617b6
-
SSDEEP
49152:EKa5cFxFUPKt8GjCWCLsH1h7iAp4m9VQCuANY0vEGaHqXXvhZml74NH:EKFxF8SeWoUEyB9VTN5ECX/hweH
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9ca41e6edbf02d6c21e3a9f6da999202e2c5f60e3e72987ff81e18c1f9a70fe.exe"C:\Users\Admin\AppData\Local\Temp\c9ca41e6edbf02d6c21e3a9f6da999202e2c5f60e3e72987ff81e18c1f9a70fe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tuzi_nsudo\NSudo.exe"C:\Users\Admin\AppData\Local\Temp\tuzi_nsudo\NSudo.exe" -U:S "C:\Users\Admin\AppData\Local\Temp\c9ca41e6edbf02d6c21e3a9f6da999202e2c5f60e3e72987ff81e18c1f9a70fe.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
247KB
MD55cae01aea8ed390ce9bec17b6c1237e4
SHA13a80a49efaac5d839400e4fb8f803243fb39a513
SHA25619896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618
SHA512c8e54c92133ba686238ea554c1cd82ba441db5fd4b0cbd5082d5eb4ddfcedd15506b9dac553459d0b2221c75778241f926ed3eef64571e4b1e0eb6f80ff9b481
-
Filesize
211B
MD5922322fab45a284dbb248760125dfb1c
SHA1120e77b90baa85287b2ee5bc63ff7dcd149767b5
SHA256254beac232a7bb20289b0608db5a0ccc69789fb8befe2bf3c76fa09953eea6f5
SHA512899dc404559518e311343a0a71ef4f88e4820268ff821082400660647259594cb1a088359c75b17f4e0df85ea5ad91e49b3e86f636e95955c2c56f1e667f4aaf
-
-
Filesize
12.6MB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
12.6MB