Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
26-04-2023 14:05
General
-
Target
tmp.exe
-
Size
12.2MB
-
MD5
1f175ba162cc415dc0bef233b5b41ff4
-
SHA1
a2f55c5b155fe067e74fbbc4ae8c5f869d455df2
-
SHA256
3a7c5d96b8bc4cc967455d0285f85dcca94c3a29d5c94589471dc75bfec120c9
-
SHA512
ebcf6864b92a02bc6c7c039ee32673f7da16d262aadd14b158bffc661c09a45ca4ec4a93a18e1f6e27718fdeae3c7a24906db40bbf2e282d2ea51489c9901375
-
SSDEEP
196608:G9tjMI+N7N+84ja44HKDQBKkXy+XWt815j5tDobSUFQjYYG17qQMXLLsnw:ej8obja4aK0BK+Hvj5t0ZFQLQMcw
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 30 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 26 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÔʼºÏ»÷v2.0[¶Ü].exe"C:\Users\Admin\AppData\Local\Temp\ÔʼºÏ»÷v2.0[¶Ü].exe"2⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Tmp\a1ac0b7c5a7d20090cc4bdd9e62f24d1\ÔʼºÏ»÷v2.0.exe"C:\Tmp\a1ac0b7c5a7d20090cc4bdd9e62f24d1\ÔʼºÏ»÷v2.0.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s SysMain1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.2MB
MD5a1ac0b7c5a7d20090cc4bdd9e62f24d1
SHA1bdd8e697d4f3b2bba3bbafef4745451775e92f49
SHA25654fbff41225c2cb4725b8cb68eb550a2340c54bb77e572988ffd3c2ab49b937e
SHA512a5aa50a732454be8fcfc758ae8d039759e2ea09096dc14b856857afdf376ef5ac705b68f768d319c3f9e967f98520b75687eca05377a774ea1595656fd964b67
-
Filesize
6.2MB
MD5a1ac0b7c5a7d20090cc4bdd9e62f24d1
SHA1bdd8e697d4f3b2bba3bbafef4745451775e92f49
SHA25654fbff41225c2cb4725b8cb68eb550a2340c54bb77e572988ffd3c2ab49b937e
SHA512a5aa50a732454be8fcfc758ae8d039759e2ea09096dc14b856857afdf376ef5ac705b68f768d319c3f9e967f98520b75687eca05377a774ea1595656fd964b67
-
Filesize
6.2MB
MD5a1ac0b7c5a7d20090cc4bdd9e62f24d1
SHA1bdd8e697d4f3b2bba3bbafef4745451775e92f49
SHA25654fbff41225c2cb4725b8cb68eb550a2340c54bb77e572988ffd3c2ab49b937e
SHA512a5aa50a732454be8fcfc758ae8d039759e2ea09096dc14b856857afdf376ef5ac705b68f768d319c3f9e967f98520b75687eca05377a774ea1595656fd964b67
-
Filesize
1.6MB
MD536e632ab7ef7d87cf60d7461dab1181f
SHA1820ef123db5a7cf3023c38e99eb267e0bcecdd53
SHA25631c716bb6b8cecffcbda9e56fd595339512465ac02d52989ba01590b0528a8a0
SHA512f70ee62945d9200e63e54771457debdfede7dc39b3d71df12d13a260322e670e753240ddc414915cb66e3def57f6d30cb82ce442df278ef760e33e52fb99f644
-
Filesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
Filesize
1.6MB
MD55870ea0d6ba8dd6e2008466bdd00e0f4
SHA1d41bf60d0dedff90e3cfc1b41b7e1a73df39a7d5
SHA2565a7dac8c8b5d7cf1115246dfaf994e7f50e16a7eac1488642396f5e23fddfe0d
SHA5120c620d5e7383adcf979feccc3b1bad584a5cec8b3d74d0ace8bb786f1f04ba87fa70d59d041dc3833977d44a75f2070181d4054c7c0b9c4ce2d66249b4b3c837
-
Filesize
137KB
MD5f6b847a54cfb804a25b8842b45fd1d50
SHA1bb22fef07ce1577c8a7fa057d8cf05502c013bfc
SHA2565dd2f5a957946e0b6f63660ebd897851aad4795d4c847396c47ddbb647715583
SHA512dd08a55f538e2a33e6a0c496dc97ae9045594cbbf62f7894ae8ded63f4dc0b2e89c5935269adfd1c19607b1d2474bddc49f6acb955e6dc53a55560663ca2137a
-
Filesize
986B
MD592b627d7156fb99821079b0cf2982f45
SHA1bb36523ddd3ad0c915687b38c49a1098678da3f6
SHA256d6223567e4a0262b18038037b9ebcbeb3afb800a50b18b111029b2ff00a278f5
SHA5124e23af68e0759e69f789fc8b9829af0bc14b9144796adb90f5ba3237ba3f3b2d0c9e92307560306e2842eb7573e58cc1dc112001a514f337e413456e573305c3
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
15.2MB
-
Filesize
96KB
-
Filesize
4.2MB
-
Filesize
96KB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
44KB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
44KB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
15.2MB
-
Filesize
4.2MB
-
Filesize
4KB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4KB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.2MB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.2MB
-
Filesize
1.7MB
-
Filesize
4.2MB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.2MB
-
Filesize
96KB
-
Filesize
15.2MB
-
Filesize
44KB
-
Filesize
4.2MB
-
Filesize
96KB
-
Filesize
44KB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
15.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4KB
-
Filesize
732KB
-
Filesize
8.7MB
-
Filesize
8.7MB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
8.7MB
-
Filesize
4KB
-
Filesize
8.7MB