Analysis
-
max time kernel
28s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
13-03-2023 09:30
General
-
Target
7b57f39fc8cfbf8d896c0468f7640512.exe
-
Size
421KB
-
MD5
7b57f39fc8cfbf8d896c0468f7640512
-
SHA1
497ef03da6ce578062d95e2da51064a39f336feb
-
SHA256
c909c9df49a76adc3db9ad0d8c2479797eef241130bdd4f84f6365f42b441c90
-
SHA512
da6d57002a2f1f4bafacd6e45828c1c34c5b2d2419ea84d303a7ea93b8bd55091d3c9527d37c6527d6637ec2680c635797d385b881d94acfbb77151f7b7e1b84
-
SSDEEP
12288:wFbL30Y6+PI9WEzuTFjYHjD0PwfaIwOYs2:qXn6rIdmP+ca8Ys
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b57f39fc8cfbf8d896c0468f7640512.exe"C:\Users\Admin\AppData\Local\Temp\7b57f39fc8cfbf8d896c0468f7640512.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
1.6MB
-
Filesize
248KB
-
Filesize
1.6MB