Analysis
-
max time kernel
146s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
27-11-2022 17:38
General
-
Target
3c14019ed3c2ae8879f3d9a43a4e273d3ec75366f2863361951fb8850753f828.exe
-
Size
108KB
-
MD5
1d2d18ead497cf60bcf49f5dc37e91ac
-
SHA1
c5507ae27c204b22b2b74eb59dbba4eb836a20f1
-
SHA256
3c14019ed3c2ae8879f3d9a43a4e273d3ec75366f2863361951fb8850753f828
-
SHA512
01cc5aeb8dd7a57bf62051b7d83867c8ec59bd22679b0a44a5ae896e0f55388b73336718fd2e735051eb9fe750f15fe6f2e205fd67b37d179f042c5a353b2c15
-
SSDEEP
3072:XP+pbPWV83QB5tWq0l7dDP+1N3bwCB+RtRFqsn8FD+vBZLLB:mpDWVUQPtWPBz7P
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c14019ed3c2ae8879f3d9a43a4e273d3ec75366f2863361951fb8850753f828.exe"C:\Users\Admin\AppData\Local\Temp\3c14019ed3c2ae8879f3d9a43a4e273d3ec75366f2863361951fb8850753f828.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://dreamcrydc.blog.163.com/2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb941346f8,0x7ffb94134708,0x7ffb941347183⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
-
Filesize
416KB
-
Filesize
416KB
-
Filesize
416KB
-
Filesize
416KB
-
Filesize
416KB
-
Filesize
416KB