Analysis
-
max time kernel
111s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
26-11-2022 23:27
General
-
Target
6686cc875a4adf78aa0d282efc3a13944b7fd95c9ee262cf762edf17ff8c3c14.exe
-
Size
11.0MB
-
MD5
48d364a7ada809d065de104ac081f574
-
SHA1
bd98757417a1a381f065c65171d05e5256c799c9
-
SHA256
6686cc875a4adf78aa0d282efc3a13944b7fd95c9ee262cf762edf17ff8c3c14
-
SHA512
ac39151832e1acb764b5a9e6d9d9ddd89aa93c24e7bf361ba598fb1a1eb5b58b4329124261364dff3c0e0a7c3e43a676a3707da1d297b79d5edaf0ee293ec415
-
SSDEEP
196608:Zo+6V21shWOp620S6xmYY1b7TUoyiD3/x7XJNiVsv++bBziFQfx+kkhRK6+skCXK:421shWOp626mYY1tyiD3liVsv++bBzir
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 3 IoCs
-
Executes dropped EXE 1 IoCs
-
VMProtect packed file 6 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6686cc875a4adf78aa0d282efc3a13944b7fd95c9ee262cf762edf17ff8c3c14.exe"C:\Users\Admin\AppData\Local\Temp\6686cc875a4adf78aa0d282efc3a13944b7fd95c9ee262cf762edf17ff8c3c14.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\images.exeC:\Users\Admin\AppData\Local\Temp\images.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\images.exeFilesize
1.7MB
MD534641bf50b7ce617e8a969c2d155df77
SHA1849f290d09a270356a9f12f4d9f22a2413ae7a6a
SHA25604f8904b1c1a42c0e45ad88f90747a18a21c53ce685e6f289cc31d73d0b06a12
SHA512fc45ae2cf58f234da80450c1b18405e31f7038c22d79b1319aaaa1b141cde21794dfec4acecd6a5410e7e4fbe351c24e56a7aa7f0e23ba3c5635ade6534e9fa4
-
C:\Users\Admin\AppData\Local\Temp\images.exeFilesize
1.7MB
MD534641bf50b7ce617e8a969c2d155df77
SHA1849f290d09a270356a9f12f4d9f22a2413ae7a6a
SHA25604f8904b1c1a42c0e45ad88f90747a18a21c53ce685e6f289cc31d73d0b06a12
SHA512fc45ae2cf58f234da80450c1b18405e31f7038c22d79b1319aaaa1b141cde21794dfec4acecd6a5410e7e4fbe351c24e56a7aa7f0e23ba3c5635ade6534e9fa4
-
memory/456-141-0x0000000000000000-mapping.dmp
-
memory/4788-132-0x0000000000400000-0x0000000000F27000-memory.dmpFilesize
11.2MB
-
memory/4788-133-0x0000000000400000-0x0000000000F27000-memory.dmpFilesize
11.2MB
-
memory/4788-134-0x0000000004D60000-0x0000000004F2D000-memory.dmpFilesize
1.8MB
-
memory/4788-136-0x0000000004D60000-0x0000000004F2D000-memory.dmpFilesize
1.8MB
-
memory/4788-140-0x0000000004D60000-0x0000000004F2D000-memory.dmpFilesize
1.8MB
-
memory/4788-144-0x0000000000400000-0x0000000000F27000-memory.dmpFilesize
11.2MB
-
memory/4788-145-0x0000000004D60000-0x0000000004F2D000-memory.dmpFilesize
1.8MB