Overview

overview

10

Static

static

3

f17a32f959...5c.exe

windows7-x64

10

f17a32f959...5c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-06-2023 20:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f17a32f959519edf781370c452c995e99c3c1b67049204a0ff010a377d3a0c5c.exe

  • Size

    359KB

  • MD5

    38c7439ad0a854c40af9f60532a5d082

  • SHA1

    46119a9614ceb26cb9259365367918adfe1171c4

  • SHA256

    f17a32f959519edf781370c452c995e99c3c1b67049204a0ff010a377d3a0c5c

  • SHA512

    347241e51f442ccf4d74b79c192d401a928e20c557a4b51981d0d95c3e07be62e6fdb71746bd995b7d28c309f5c0eaf8f2cee6304c8423f5ad6f5ad9c4861e31

  • SSDEEP

    6144:niF5O8bZk/FwD82Hdmg0Vy7uN5CVXrioW4YEBRVtat/l5r:no5D9k/+/iv2FYEzVtaD5r

Score
10/10
blackmoongh0stratbankerpersistencerattrojan

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon
  • Detect Blackmoon payload 9 IoCs
  • Gh0st RAT payload 3 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f17a32f959519edf781370c452c995e99c3c1b67049204a0ff010a377d3a0c5c.exe
    "C:\Users\Admin\AppData\Local\Temp\f17a32f959519edf781370c452c995e99c3c1b67049204a0ff010a377d3a0c5c.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5068
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\f17a32f959519edf781370c452c995e99c3c1b67049204a0ff010a377d3a0c5c.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:1436

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\f17a32f959519edf781370c452c995e99c3c1b67049204a0ff010a377d3a0c5c.txt
    Filesize

    120KB

    MD5

    3aea5b78bac5359a799c2714fecccd1a

    SHA1

    5d3203b328ecfc7a55c0ded1032d209e9f273367

    SHA256

    c05e763cab67cf9daf5be7a6a6cff2650223987a9693eaa119f69b2bbb6df6c3

    SHA512

    9513cc84a7ed3dd709d4affb03f6e286dcd43e82f33441c00a9d74d2b45449f2ee20baa8db46218d7a59d9e62fb7f95050ea305166e70f3e71dde39ccf07b6d3

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\jgty.dll
    Filesize

    2KB

    MD5

    7943effe67a4647e06def2348949020e

    SHA1

    eabd561f0639a975de259633f63896d82c3f878d

    SHA256

    3fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa

    SHA512

    c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\jgty.dll
    Filesize

    2KB

    MD5

    7943effe67a4647e06def2348949020e

    SHA1

    eabd561f0639a975de259633f63896d82c3f878d

    SHA256

    3fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa

    SHA512

    c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003

    Download Submit
  • C:\Users\Public\Documents\gtth.dll
    Filesize

    2KB

    MD5

    7943effe67a4647e06def2348949020e

    SHA1

    eabd561f0639a975de259633f63896d82c3f878d

    SHA256

    3fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa

    SHA512

    c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003

    Download Submit
  • C:\Users\Public\Documents\sjsw.log
    Filesize

    248B

    MD5

    8a8cef8c5f1e85f855ebc768a4f3d544

    SHA1

    c593386dbf334cb683e008e3d3677b476e8dbaf2

    SHA256

    07fe564873c8fec3be54d66bfa34534b4c76576ffe996008dbfbda1ed5d5de78

    SHA512

    23866b542f620fadd65b842c737bc0a7a42986cf15c4452cdf6c94099677a56f2835a5817fa60140a14d3ef69da79f022fff6cf097377db7a99ca651b2633a8b

    Download Submit
  • memory/5068-208-0x0000000000400000-0x00000000004E7000-memory.dmp
    Filesize

    924KB

    Download
  • memory/5068-173-0x0000000003E10000-0x0000000003F02000-memory.dmp
    Filesize

    968KB

    Download
  • memory/5068-133-0x0000000000400000-0x00000000004E7000-memory.dmp
    Filesize

    924KB

    Download
  • memory/5068-141-0x0000000002450000-0x000000000248B000-memory.dmp
    Filesize

    236KB

    Download
  • memory/5068-148-0x0000000002FE0000-0x0000000003046000-memory.dmp
    Filesize

    408KB

    Download
  • memory/5068-147-0x0000000002FE0000-0x0000000003046000-memory.dmp
    Filesize

    408KB

    Download
  • memory/5068-150-0x0000000002FE0000-0x0000000003046000-memory.dmp
    Filesize

    408KB

    Download
  • memory/5068-151-0x00000000024A0000-0x00000000024A3000-memory.dmp
    Filesize

    12KB

    Download
  • memory/5068-140-0x0000000002450000-0x000000000248B000-memory.dmp
    Filesize

    236KB

    Download
  • memory/5068-139-0x0000000002450000-0x000000000248B000-memory.dmp
    Filesize

    236KB

    Download
  • memory/5068-188-0x0000000002FE0000-0x0000000003046000-memory.dmp
    Filesize

    408KB

    Download
  • memory/5068-142-0x0000000000800000-0x0000000000803000-memory.dmp
    Filesize

    12KB

    Download
  • memory/5068-174-0x0000000000400000-0x0000000000427000-memory.dmp
    Filesize

    156KB

    Download
  • memory/5068-175-0x0000000003E10000-0x0000000003F02000-memory.dmp
    Filesize

    968KB

    Download
  • memory/5068-177-0x0000000010000000-0x0000000010017000-memory.dmp
    Filesize

    92KB

    Download
  • memory/5068-176-0x0000000010001000-0x000000001000F000-memory.dmp
    Filesize

    56KB

    Download
  • memory/5068-179-0x0000000000400000-0x0000000000427000-memory.dmp
    Filesize

    156KB

    Download
  • memory/5068-172-0x0000000003E10000-0x0000000003F02000-memory.dmp
    Filesize

    968KB

    Download
  • memory/5068-189-0x0000000000400000-0x0000000000427000-memory.dmp
    Filesize

    156KB

    Download
  • memory/5068-190-0x0000000002FE0000-0x0000000003046000-memory.dmp
    Filesize

    408KB

    Download
  • memory/5068-192-0x0000000010000000-0x0000000010003000-memory.dmp
    Filesize

    12KB

    Download
  • memory/5068-193-0x0000000002450000-0x000000000248B000-memory.dmp
    Filesize

    236KB

    Download
  • memory/5068-134-0x0000000000610000-0x0000000000613000-memory.dmp
    Filesize

    12KB

    Download