Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
13-03-2023 09:30
General
-
Target
7b57f39fc8cfbf8d896c0468f7640512.exe
-
Size
421KB
-
MD5
7b57f39fc8cfbf8d896c0468f7640512
-
SHA1
497ef03da6ce578062d95e2da51064a39f336feb
-
SHA256
c909c9df49a76adc3db9ad0d8c2479797eef241130bdd4f84f6365f42b441c90
-
SHA512
da6d57002a2f1f4bafacd6e45828c1c34c5b2d2419ea84d303a7ea93b8bd55091d3c9527d37c6527d6637ec2680c635797d385b881d94acfbb77151f7b7e1b84
-
SSDEEP
12288:wFbL30Y6+PI9WEzuTFjYHjD0PwfaIwOYs2:qXn6rIdmP+ca8Ys
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 1 IoCs
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b57f39fc8cfbf8d896c0468f7640512.exe"C:\Users\Admin\AppData\Local\Temp\7b57f39fc8cfbf8d896c0468f7640512.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4792-133-0x0000000000400000-0x0000000000595000-memory.dmpFilesize
1.6MB
-
memory/4792-134-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4792-135-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4792-136-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4792-138-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4792-140-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4792-142-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4792-144-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4792-146-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4792-148-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4792-150-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4792-152-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4792-154-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4792-156-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4792-158-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4792-160-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4792-162-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4792-164-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4792-166-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4792-168-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4792-172-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4792-170-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4792-176-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4792-174-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4792-177-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4792-178-0x0000000000400000-0x0000000000595000-memory.dmpFilesize
1.6MB
-
memory/4792-179-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB