Analysis
-
max time kernel
28s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
19-03-2023 05:59
General
-
Target
tmp.exe
-
Size
2.7MB
-
MD5
4570ee55ec47299b547232e3463feff1
-
SHA1
6626b895c309b6592deb2e6b2fffaa52049a3e73
-
SHA256
f3a9d6f2975046adf3b4e8fd36d93157ffe91db28f2f7e0344ae26ebcd2102ab
-
SHA512
d6bd5b74a227725e602657467f14d3ea464f78e2b9edabe78a19cc56541fcebba478c40187b5219a78e79cbfa7e050ecd3062b2a44913a3b1c13e0498b267ee1
-
SSDEEP
49152:+Py1srbLbywBoM631OztfKyLRmFpPOAq1aPo6dVkZigSZvHc4vsDT:W9rbLby3h38ZflLRWPnq1adkZYZfc4v
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1340-54-0x00000000002A0000-0x00000000002C3000-memory.dmpFilesize
140KB
-
memory/1340-55-0x0000000003090000-0x0000000003366000-memory.dmpFilesize
2.8MB
-
memory/1340-56-0x0000000000400000-0x00000000006BC000-memory.dmpFilesize
2.7MB
-
memory/1340-58-0x00000000002A0000-0x00000000002C3000-memory.dmpFilesize
140KB
-
memory/1340-57-0x0000000010000000-0x0000000010016000-memory.dmpFilesize
88KB
-
memory/1340-59-0x0000000003090000-0x0000000003366000-memory.dmpFilesize
2.8MB
-
memory/1340-60-0x0000000010000000-0x0000000010016000-memory.dmpFilesize
88KB