Analysis
-
max time kernel
31s -
max time network
36s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
22-03-2023 08:49
General
-
Target
d0d05ec10590781112d9d6c8c03131058a57977154f919b124305a2a75194f64.exe
-
Size
1.7MB
-
MD5
9160dc004f19ef38f0f05eedca29d2b7
-
SHA1
eaf2463e9dc5747b7d8e13dd2e3576ccb7280048
-
SHA256
d0d05ec10590781112d9d6c8c03131058a57977154f919b124305a2a75194f64
-
SHA512
8a8adbdc8a82d7fe9e460b819569ae1747e722675f1c8f1edc04b06d1e9b3f9a472ba1ac9d4e5ec1263090288c1a3c79ce82bced019e0cd5103535b0fbba6c41
-
SSDEEP
24576:jIlYZaol8VPqLAzlcd3Sa/MQ7tyej73z9mc3C0rEToS2/0NGxZjrDQGDcKANWGpu:8auMUTrCDcKMWKlhm23akQphXwouW
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 3 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0d05ec10590781112d9d6c8c03131058a57977154f919b124305a2a75194f64.exe"C:\Users\Admin\AppData\Local\Temp\d0d05ec10590781112d9d6c8c03131058a57977154f919b124305a2a75194f64.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d0d05ec10590781112d9d6c8c03131058a57977154f919b124305a2a75194f64.exeC:\Users\Admin\AppData\Local\Temp\d0d05ec10590781112d9d6c8c03131058a57977154f919b124305a2a75194f64.exe --2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD51e418c3f1f7cc47f1d4a95a79c956862
SHA1b22befde8e6872c02b807a7c358aaadfae0b4bbd
SHA256569551d525d0c83cdabbe4de2e6d4ce7a4cb03b5878f3a19701519a0f9c2eb3b
SHA51241d6551a75bcabe64a6c61633cb89e21218dff4ad4d43eb82126888f8dbd01638628064e6878e34bd30875a88790ecef1bb969b45e05643b1e058797048c5b37
-
Filesize
1.7MB
MD51e418c3f1f7cc47f1d4a95a79c956862
SHA1b22befde8e6872c02b807a7c358aaadfae0b4bbd
SHA256569551d525d0c83cdabbe4de2e6d4ce7a4cb03b5878f3a19701519a0f9c2eb3b
SHA51241d6551a75bcabe64a6c61633cb89e21218dff4ad4d43eb82126888f8dbd01638628064e6878e34bd30875a88790ecef1bb969b45e05643b1e058797048c5b37
-
Filesize
1.9MB