Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
12-05-2023 09:36
General
-
Target
邮箱升级补丁.exe
-
Size
532KB
-
MD5
01edc3a3885e09d53064331159173217
-
SHA1
6dfbc89921b6f73aea6a71f367173dc284c2ab6d
-
SHA256
cc86d62510abdeea2b7162d0e1db859a6be677e3585099678f3d9d8683df81aa
-
SHA512
879e53c271dbcffd28ad0e227c9e2ed1cf6a4b3ad915a46ef5460b298415db64068d9001743965e9511e398040187f29ed8e0dbec94440547365876764bd64cc
-
SSDEEP
3072:QkvZbBLzNa6haoKpaagaNSTtu1xF0DN+ew3q6IL99pGU2PlwFaEFkVUX:QkvZbBLzNa6I5xNSYxuN+e7xSlQS+
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 7 IoCs
-
Gh0st RAT payload 3 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\邮箱升级补丁.exe"C:\Users\Admin\AppData\Local\Temp\邮箱升级补丁.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD57943effe67a4647e06def2348949020e
SHA1eabd561f0639a975de259633f63896d82c3f878d
SHA2563fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa
SHA512c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003
-
Filesize
2KB
MD57943effe67a4647e06def2348949020e
SHA1eabd561f0639a975de259633f63896d82c3f878d
SHA2563fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa
SHA512c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003
-
Filesize
2KB
MD57943effe67a4647e06def2348949020e
SHA1eabd561f0639a975de259633f63896d82c3f878d
SHA2563fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa
SHA512c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003
-
Filesize
2KB
MD57943effe67a4647e06def2348949020e
SHA1eabd561f0639a975de259633f63896d82c3f878d
SHA2563fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa
SHA512c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003
-
Filesize
172B
MD5e16a3505366aa1ef004814b9af7defa0
SHA11c0bc113ba289163aa9bd8bba0063518cd0a7982
SHA2564247b7404f01a9ef859aaf9279794ac2cd7c9de07fc3f02f7e24fc92886978b0
SHA512adb6a83b13eaeccf10dbf046712feb88e604982694a3fc0370558509e0543a4955d869798fd851b615345919317c9e31f09cb63ce75576cb03e14f5cce15ffca
-
Filesize
12KB
-
Filesize
92KB
-
Filesize
228KB
-
Filesize
12KB
-
Filesize
228KB
-
Filesize
12KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
300KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
156KB
-
Filesize
944KB
-
Filesize
172KB
-
Filesize
56KB
-
Filesize
228KB
-
Filesize
156KB
-
Filesize
300KB
-
Filesize
156KB
-
Filesize
300KB
-
Filesize
172KB
-
Filesize
228KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB