Analysis
-
max time kernel
28s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
12-05-2023 07:29
General
-
Target
11c6c95e01f1ca6c4480fff356afcc4fb9de8623edd4953e350451e395274d10.exe
-
Size
816KB
-
MD5
9542b32dd95d60fa9bf0866208b1a0ad
-
SHA1
b0eb3ca130e56be28f7d7b787dcee1aa11bfa246
-
SHA256
11c6c95e01f1ca6c4480fff356afcc4fb9de8623edd4953e350451e395274d10
-
SHA512
33d0222bf3bf148179eb5e619f2eb9a4e07330a5f1ac1ad0d1953f047adef168fe8201664f68fb584f01b81bc075b3c22280c65cf9028e73d9a9ff83a14b9114
-
SSDEEP
12288:jg3dMdIu2T546BaoWuZIpZut+VT3KNOiAAZWIHU8c0gacqa:jg3dMdIu2l4oaju+/u3wEU90ga
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 3 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\11c6c95e01f1ca6c4480fff356afcc4fb9de8623edd4953e350451e395274d10.exe"C:\Users\Admin\AppData\Local\Temp\11c6c95e01f1ca6c4480fff356afcc4fb9de8623edd4953e350451e395274d10.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD57943effe67a4647e06def2348949020e
SHA1eabd561f0639a975de259633f63896d82c3f878d
SHA2563fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa
SHA512c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
12KB