Analysis

  • max time kernel
    39s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 20:52

General

  • Target

    b84e1db35ad727baa786e3be053842ac2287cd70ec2b00c4e432a46c37e357fc.exe

  • Size

    235KB

  • MD5

    3feeb7f577c103331bfbda98b277ad51

  • SHA1

    3a765c4134d9e4bfe3b183d73ee4ba019f36950b

  • SHA256

    b84e1db35ad727baa786e3be053842ac2287cd70ec2b00c4e432a46c37e357fc

  • SHA512

    7aa4a2451fc557d422d0ae6b5415fda1e409dbcc8c14bb47eb9399b6fb9f7a58ffe74a04cfc82e4e4ab91116d757b9a5e84ff4c6c4e751211a0e3f0581045ab4

  • SSDEEP

    6144:sdeLBJlFruKcmHmBs2oSuMfT+WWhNw3Bxxpj7diQ:sQLBJlBcZo6fTyhIRf

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b84e1db35ad727baa786e3be053842ac2287cd70ec2b00c4e432a46c37e357fc.exe
    "C:\Users\Admin\AppData\Local\Temp\b84e1db35ad727baa786e3be053842ac2287cd70ec2b00c4e432a46c37e357fc.exe"
    1⤵
      PID:1408

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1408-54-0x00000000750A1000-0x00000000750A3000-memory.dmp

            Filesize

            8KB

          • memory/1408-55-0x0000000000400000-0x00000000004E2000-memory.dmp

            Filesize

            904KB

          • memory/1408-56-0x0000000000400000-0x00000000004E2000-memory.dmp

            Filesize

            904KB