Overview

overview

10

Static

static

7

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    06-06-2023 21:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tmp.exe

  • Size

    3.5MB

  • MD5

    c98f169c204562fab20fffb2417e037a

  • SHA1

    e8fa26609efe1eac8022cf3264dba0b0a6016f58

  • SHA256

    022607c07e9fa8c9140025038d0e2942451be2f03fa509c7fe4d9c787d2d0dc9

  • SHA512

    ab5186a1e5d9b201a7cc8602ec67184a3a1ba713950bc95e81e72129aff315a5baa0f07da061c53dda85282091d36aea69efbd6747b87c1aca190cb3191da88b

  • SSDEEP

    98304:Mx/uQFSYBhY+Xbz1Uf9gIfkv2RDeMc5UNcAq0ieI7ngIBxPDty:MxGblvBRm5znZBxDE

Score
10/10
blackmoonbankerbootkitpersistencetrojanupx

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon
  • Detect Blackmoon payload 5 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 7 IoCs
  • UPX packed file 54 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Users\Admin\AppData\Local\Temp\×Ô¶¯Ñ§Ï°(Íⲿ¹È¸è°æ).exe
      C:\Users\Admin\AppData\Local\Temp\×Ô¶¯Ñ§Ï°(Íⲿ¹È¸è°æ).exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2812
      • C:\Users\Admin\AppData\Local\Temp\Chrome.xx
        C:\Users\Admin\AppData\Local\Temp\Chrome.xx
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Writes to the Master Boot Record (MBR)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2988

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Chrome.xx
    Filesize

    3.5MB

    MD5

    c98f169c204562fab20fffb2417e037a

    SHA1

    e8fa26609efe1eac8022cf3264dba0b0a6016f58

    SHA256

    022607c07e9fa8c9140025038d0e2942451be2f03fa509c7fe4d9c787d2d0dc9

    SHA512

    ab5186a1e5d9b201a7cc8602ec67184a3a1ba713950bc95e81e72129aff315a5baa0f07da061c53dda85282091d36aea69efbd6747b87c1aca190cb3191da88b

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\HPSocket4C.dll
    Filesize

    2.1MB

    MD5

    04869ada712c189caba4822be0e81ea5

    SHA1

    9c45486b30e6d3ccf0737c5766796baaf58232ab

    SHA256

    23078015adb0cf53ebf632a895a1a224b3718174e6c2887e1bbb2d28be5e2b8b

    SHA512

    16f98af15583c60da0cb947ea2230f759bfa27f86ef93ef5f7ffe2adcec6c5f115f52ffa74bae6cf8add94bb6a380fa276f391619256be7a45c53bb7421fdd9c

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\RapidJSON.dll
    Filesize

    126KB

    MD5

    06567999fb99885b06c69740eaf13430

    SHA1

    0411b572e70b44fecb694f9930d5c8bc6db51d3c

    SHA256

    4ab513e6b4d0e72981c2b2ce91c13f183704bb067d21713cd6c2f9b53a545728

    SHA512

    170d99cf5f6bae1c4ef8165a7e75033e2050e49aa5f65a094bb9cec646e72321cb121f3fb0c2b9ad1e9aa8155c67699ba7c03e6b703f2531d9cd185423dabf0f

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\×Ô¶¯Ñ§Ï°(Íⲿ¹È¸è°æ).exe
    Filesize

    544KB

    MD5

    b845df3aaaad96d130c777e0f1fc8c6d

    SHA1

    9983a70ecaa59c2b971fce43d3536dcaef11a799

    SHA256

    2757622e10dfe3c86c4b32d6bb8af6745af1bc797a2a1761e7f0be08350b66c5

    SHA512

    7a77f43f7628714315b7c65fa719dcf736601fe028ff207e23316b3167f848030d8cbcbccff3e067713d6fe3a6310b72152a820f9c80841e6812f86be43f22c6

    Download Submit
  • \Users\Admin\AppData\Local\Temp\Chrome.xx
    Filesize

    3.5MB

    MD5

    c98f169c204562fab20fffb2417e037a

    SHA1

    e8fa26609efe1eac8022cf3264dba0b0a6016f58

    SHA256

    022607c07e9fa8c9140025038d0e2942451be2f03fa509c7fe4d9c787d2d0dc9

    SHA512

    ab5186a1e5d9b201a7cc8602ec67184a3a1ba713950bc95e81e72129aff315a5baa0f07da061c53dda85282091d36aea69efbd6747b87c1aca190cb3191da88b

    Download Submit
  • \Users\Admin\AppData\Local\Temp\Chrome.xx
    Filesize

    3.5MB

    MD5

    c98f169c204562fab20fffb2417e037a

    SHA1

    e8fa26609efe1eac8022cf3264dba0b0a6016f58

    SHA256

    022607c07e9fa8c9140025038d0e2942451be2f03fa509c7fe4d9c787d2d0dc9

    SHA512

    ab5186a1e5d9b201a7cc8602ec67184a3a1ba713950bc95e81e72129aff315a5baa0f07da061c53dda85282091d36aea69efbd6747b87c1aca190cb3191da88b

    Download Submit
  • \Users\Admin\AppData\Local\Temp\HPSocket4C.dll
    Filesize

    2.1MB

    MD5

    04869ada712c189caba4822be0e81ea5

    SHA1

    9c45486b30e6d3ccf0737c5766796baaf58232ab

    SHA256

    23078015adb0cf53ebf632a895a1a224b3718174e6c2887e1bbb2d28be5e2b8b

    SHA512

    16f98af15583c60da0cb947ea2230f759bfa27f86ef93ef5f7ffe2adcec6c5f115f52ffa74bae6cf8add94bb6a380fa276f391619256be7a45c53bb7421fdd9c

    Download Submit
  • \Users\Admin\AppData\Local\Temp\HPSocket4C.dll
    Filesize

    2.1MB

    MD5

    04869ada712c189caba4822be0e81ea5

    SHA1

    9c45486b30e6d3ccf0737c5766796baaf58232ab

    SHA256

    23078015adb0cf53ebf632a895a1a224b3718174e6c2887e1bbb2d28be5e2b8b

    SHA512

    16f98af15583c60da0cb947ea2230f759bfa27f86ef93ef5f7ffe2adcec6c5f115f52ffa74bae6cf8add94bb6a380fa276f391619256be7a45c53bb7421fdd9c

    Download Submit
  • \Users\Admin\AppData\Local\Temp\RapidJSON.dll
    Filesize

    126KB

    MD5

    06567999fb99885b06c69740eaf13430

    SHA1

    0411b572e70b44fecb694f9930d5c8bc6db51d3c

    SHA256

    4ab513e6b4d0e72981c2b2ce91c13f183704bb067d21713cd6c2f9b53a545728

    SHA512

    170d99cf5f6bae1c4ef8165a7e75033e2050e49aa5f65a094bb9cec646e72321cb121f3fb0c2b9ad1e9aa8155c67699ba7c03e6b703f2531d9cd185423dabf0f

    Download Submit
  • \Users\Admin\AppData\Local\Temp\×Ô¶¯Ñ§Ï°(Íⲿ¹È¸è°æ).exe
    Filesize

    544KB

    MD5

    b845df3aaaad96d130c777e0f1fc8c6d

    SHA1

    9983a70ecaa59c2b971fce43d3536dcaef11a799

    SHA256

    2757622e10dfe3c86c4b32d6bb8af6745af1bc797a2a1761e7f0be08350b66c5

    SHA512

    7a77f43f7628714315b7c65fa719dcf736601fe028ff207e23316b3167f848030d8cbcbccff3e067713d6fe3a6310b72152a820f9c80841e6812f86be43f22c6

    Download Submit
  • \Users\Admin\AppData\Local\Temp\×Ô¶¯Ñ§Ï°(Íⲿ¹È¸è°æ).exe
    Filesize

    544KB

    MD5

    b845df3aaaad96d130c777e0f1fc8c6d

    SHA1

    9983a70ecaa59c2b971fce43d3536dcaef11a799

    SHA256

    2757622e10dfe3c86c4b32d6bb8af6745af1bc797a2a1761e7f0be08350b66c5

    SHA512

    7a77f43f7628714315b7c65fa719dcf736601fe028ff207e23316b3167f848030d8cbcbccff3e067713d6fe3a6310b72152a820f9c80841e6812f86be43f22c6

    Download Submit
  • memory/1996-90-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1996-117-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1996-84-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1996-86-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1996-58-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1996-94-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1996-98-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1996-96-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1996-92-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1996-88-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1996-76-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1996-100-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1996-101-0x0000000000400000-0x0000000000A37000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/1996-102-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1996-103-0x0000000000400000-0x0000000000A37000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/1996-104-0x0000000000400000-0x0000000000A37000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/1996-80-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1996-108-0x0000000000400000-0x0000000000A37000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/1996-78-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1996-74-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1996-72-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1996-113-0x000000001C230000-0x000000001C3BA000-memory.dmp
    Filesize

    1.5MB

    Download
  • memory/1996-114-0x000000001C230000-0x000000001C3BA000-memory.dmp
    Filesize

    1.5MB

    Download
  • memory/1996-59-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1996-116-0x0000000000400000-0x0000000000A37000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/1996-82-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1996-60-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1996-62-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1996-64-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1996-70-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1996-68-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1996-66-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2812-124-0x0000000000400000-0x000000000058A000-memory.dmp
    Filesize

    1.5MB

    Download
  • memory/2812-120-0x0000000000400000-0x000000000058A000-memory.dmp
    Filesize

    1.5MB

    Download
  • memory/2812-115-0x0000000000400000-0x000000000058A000-memory.dmp
    Filesize

    1.5MB

    Download
  • memory/2812-118-0x0000000000400000-0x000000000058A000-memory.dmp
    Filesize

    1.5MB

    Download
  • memory/2812-119-0x0000000000400000-0x000000000058A000-memory.dmp
    Filesize

    1.5MB

    Download
  • memory/2988-134-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2988-129-0x0000000000400000-0x0000000000A37000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/2988-132-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2988-130-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2988-136-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2988-138-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2988-140-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2988-142-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2988-172-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2988-173-0x0000000000400000-0x0000000000A37000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/2988-128-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2988-127-0x0000000010000000-0x000000001003E000-memory.dmp
    Filesize

    248KB

    Download