Analysis
-
max time kernel
144s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
20-03-2023 00:23
General
-
Target
b6c8beb5a80b8f9fab228391c72ee350.exe
-
Size
999KB
-
MD5
b6c8beb5a80b8f9fab228391c72ee350
-
SHA1
9b483b8592d8d80463acdd165a2f5ee5dcb50bb8
-
SHA256
0c5007b5fce15ed86f89a19cb241aa5d5f6a3f90f7f8d948a7bb659818b24d59
-
SHA512
8dd790dc8685b1c7cde8315ee097a3e7129cd0d75f54ba7f5d07ce2ef1286617edd5e7006d301f0b591044e40ba00cbf4742511a954a1798a018d70fa03861c0
-
SSDEEP
24576:qXC9ZPyhRI4btLZxoOQH1ffGeJ0Lv3qnHuRKy:ZZjcVxoOQH1ffGGkXKy
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6c8beb5a80b8f9fab228391c72ee350.exe"C:\Users\Admin\AppData\Local\Temp\b6c8beb5a80b8f9fab228391c72ee350.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
36KB
-
Filesize
2.8MB
-
Filesize
248KB