Analysis
-
max time kernel
82s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
19-03-2023 05:59
General
-
Target
tmp.exe
-
Size
2.7MB
-
MD5
4570ee55ec47299b547232e3463feff1
-
SHA1
6626b895c309b6592deb2e6b2fffaa52049a3e73
-
SHA256
f3a9d6f2975046adf3b4e8fd36d93157ffe91db28f2f7e0344ae26ebcd2102ab
-
SHA512
d6bd5b74a227725e602657467f14d3ea464f78e2b9edabe78a19cc56541fcebba478c40187b5219a78e79cbfa7e050ecd3062b2a44913a3b1c13e0498b267ee1
-
SSDEEP
49152:+Py1srbLbywBoM631OztfKyLRmFpPOAq1aPo6dVkZigSZvHc4vsDT:W9rbLby3h38ZflLRWPnq1adkZYZfc4v
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
-
Filesize
156KB
-
Filesize
140KB
-
Filesize
2.8MB
-
Filesize
140KB
-
Filesize
2.8MB
-
Filesize
2.7MB