Overview

overview

10

Static

static

8

13a516437c...1e.exe

windows7-x64

10

13a516437c...1e.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    9s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27-11-2022 19:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    13a516437c002f849dd0cb23ee060e0793030d7fe27ffa27569c0f5c3843301e.exe

  • Size

    234KB

  • MD5

    4c8fa92b933519c30ab8db9e9fdca9fa

  • SHA1

    0155a5ddd0c14cf8bab2c5a48671460537aa1266

  • SHA256

    13a516437c002f849dd0cb23ee060e0793030d7fe27ffa27569c0f5c3843301e

  • SHA512

    e613abd5b1a106b63fde8f4e884029f189a2105ff4257fef691841454232e6f6f462a2ef2e0fa3182114c162cd37c5e981f3684fe5162d03885119ffe15bc5c9

  • SSDEEP

    6144:hTfzbt72rhsMFyRerNkUFt3rpAvtqOAPKB0oS4QnJ:hTfzbheqtqVt312qO8KB0oS

Score
10/10
blackmoonbankertrojanupx

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon
  • Detect Blackmoon payload 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Processes

  • C:\Users\Admin\AppData\Local\Temp\13a516437c002f849dd0cb23ee060e0793030d7fe27ffa27569c0f5c3843301e.exe
    "C:\Users\Admin\AppData\Local\Temp\13a516437c002f849dd0cb23ee060e0793030d7fe27ffa27569c0f5c3843301e.exe"
    1⤵
      PID:804

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/804-54-0x0000000000400000-0x00000000004F5000-memory.dmp
      Filesize

      980KB

      Download
    • memory/804-55-0x0000000075931000-0x0000000075933000-memory.dmp
      Filesize

      8KB

      Download
    • memory/804-56-0x0000000000400000-0x00000000004F5000-memory.dmp
      Filesize

      980KB

      Download