Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

8

6ecdb31dd0...a1.exe

windows7-x64

10

6ecdb31dd0...a1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/11/2022, 05:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6ecdb31dd0eac23b2a8ac03b6dfc0da3fbdda45973243775d037aaf89ac5b8a1.exe

  • Size

    438KB

  • MD5

    edff2cab0b78c2a8fdabc8dbb440d2c3

  • SHA1

    113e3b0b233c073a44c06a685f68e9400e21efb6

  • SHA256

    6ecdb31dd0eac23b2a8ac03b6dfc0da3fbdda45973243775d037aaf89ac5b8a1

  • SHA512

    6a10fb5979b1d66a8461da50ad50f9d73ae1b93d9c9d74be83b97feb52388780bfd290c814bb05707a9374d622ac75d1b2664766db2e399609864945c2f6044a

  • SSDEEP

    12288:Z1w/VTZZkBi0awczzzd1VCDlYic4HNfIxoS:H+b+i0aDkBceJ

Score
10/10
blackmoonbankertrojanupx

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon
  • Detect Blackmoon payload 2 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ecdb31dd0eac23b2a8ac03b6dfc0da3fbdda45973243775d037aaf89ac5b8a1.exe
    "C:\Users\Admin\AppData\Local\Temp\6ecdb31dd0eac23b2a8ac03b6dfc0da3fbdda45973243775d037aaf89ac5b8a1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:516
    • C:\Users\Admin\AppData\Local\Temp\33196\svchost.exe
      C:\Users\Admin\AppData\Local\Temp\33196\svchost.exe
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:840
    • C:\Users\Admin\AppData\Local\Temp\331962\svchost.exe
      C:\Users\Admin\AppData\Local\Temp\331962\svchost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\331962\svchost.exe
    Filesize

    176KB

    MD5

    5d917c38c107a8a1a51431639721e148

    SHA1

    913e0ae47537d6e023e4bd46cc4e7d9da8bd128f

    SHA256

    04bc5a5b0bbf8e52fa5305df4e7cc87b96b06c8952e43e7ba801f4a34e074ea7

    SHA512

    b476963d93f5cab6ee5c2232af71a7bcbee6a26def69fb12694f6d87106b796d587e70ee619dd149bf5017b1d5f2997babfe8bc04b71c91dd4bf0ed89d09461b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\331962\svchost.exe
    Filesize

    176KB

    MD5

    5d917c38c107a8a1a51431639721e148

    SHA1

    913e0ae47537d6e023e4bd46cc4e7d9da8bd128f

    SHA256

    04bc5a5b0bbf8e52fa5305df4e7cc87b96b06c8952e43e7ba801f4a34e074ea7

    SHA512

    b476963d93f5cab6ee5c2232af71a7bcbee6a26def69fb12694f6d87106b796d587e70ee619dd149bf5017b1d5f2997babfe8bc04b71c91dd4bf0ed89d09461b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\33196\svchost.exe
    Filesize

    328KB

    MD5

    9240869c842b43abde5d9064c0517926

    SHA1

    ef13f9926408f2fc4a225de7b7b0fdf5120008ca

    SHA256

    a89ff31455e29d91ba1320b67bb063bbfb7761011d300f489f886ec2e9b0f2d8

    SHA512

    385b18b8dcc5f77078cf6fb0d76a213439dad6cb5d8c53220eb9d0e92c62c873681cd2aaaabf1ec726096606edef5306c6bd871529b0b8ae00f3b92941e16565

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\33196\svchost.exe
    Filesize

    328KB

    MD5

    9240869c842b43abde5d9064c0517926

    SHA1

    ef13f9926408f2fc4a225de7b7b0fdf5120008ca

    SHA256

    a89ff31455e29d91ba1320b67bb063bbfb7761011d300f489f886ec2e9b0f2d8

    SHA512

    385b18b8dcc5f77078cf6fb0d76a213439dad6cb5d8c53220eb9d0e92c62c873681cd2aaaabf1ec726096606edef5306c6bd871529b0b8ae00f3b92941e16565

    Download Submit

  • memory/516-132-0x0000000000400000-0x00000000004B8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/516-140-0x0000000000400000-0x00000000004B8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/840-139-0x0000000000D80000-0x0000000000F7A000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/840-141-0x0000000000D80000-0x0000000000F7A000-memory.dmp

    Filesize

    2.0MB

    Download