Overview

overview

10

Static

static

3

69b2c77f4b...7a.exe

windows7-x64

10

69b2c77f4b...7a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    07-06-2023 19:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    69b2c77f4b01443306f493791453983588976e3b2e091bca289edfa745eda77a.exe

  • Size

    2.3MB

  • MD5

    925da8f6d9daf4a747045092dfa00f45

  • SHA1

    9e0cdda54919e0968a34dc418b7ad32bd0dc6ff3

  • SHA256

    69b2c77f4b01443306f493791453983588976e3b2e091bca289edfa745eda77a

  • SHA512

    6e8a0313bb2781ba2cc631d314a363bd7231cd8cfa3165a5f1e32ca61b9e0e0e573edbda7323e96ea6a494e212f3edea186c807a6d72a199f442dcd8560118ba

  • SSDEEP

    49152:4VTl30e7fqneJeGI1jrrM20N7LX3fESdzX2zUaunG5a8s/0zB9ddWxKDTQ/k2X8:4ZyeMeMjM2SLfEY2UauG5D60zBHdWowS

Score
10/10
blackmoonbankertrojanupx

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon
  • Detect Blackmoon payload 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69b2c77f4b01443306f493791453983588976e3b2e091bca289edfa745eda77a.exe
    "C:\Users\Admin\AppData\Local\Temp\69b2c77f4b01443306f493791453983588976e3b2e091bca289edfa745eda77a.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2012-54-0x00000000767D0000-0x0000000076817000-memory.dmp
    Filesize

    284KB

    Download
  • memory/2012-464-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-465-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-463-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-462-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-461-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-460-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-467-0x0000000000400000-0x00000000006F9000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/2012-466-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-470-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-469-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-468-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-471-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-472-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-478-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-477-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-476-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-475-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-474-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-473-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-523-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-522-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-521-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-520-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-519-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-518-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-517-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-516-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-515-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-514-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-513-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-512-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-511-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-510-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-509-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-508-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-507-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-506-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-505-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-504-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-503-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-502-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-501-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-500-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-499-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-498-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-497-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-496-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-495-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-494-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-493-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-492-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-491-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-490-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-489-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-488-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-487-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-486-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-485-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-484-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-483-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-482-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-481-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-480-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-479-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-1386-0x00000000020B0000-0x00000000021B0000-memory.dmp
    Filesize

    1024KB

    Download
  • memory/2012-1388-0x00000000022C0000-0x0000000002441000-memory.dmp
    Filesize

    1.5MB

    Download
  • memory/2012-4805-0x0000000002570000-0x0000000002681000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2012-4806-0x0000000002450000-0x0000000002551000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/2012-4808-0x00000000020B0000-0x00000000021B0000-memory.dmp
    Filesize

    1024KB

    Download
  • memory/2012-4809-0x0000000002CE0000-0x0000000002D16000-memory.dmp
    Filesize

    216KB

    Download
  • memory/2012-4811-0x0000000003280000-0x0000000003281000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2012-4810-0x0000000002D20000-0x0000000002D33000-memory.dmp
    Filesize

    76KB

    Download
  • memory/2012-4813-0x00000000064C0000-0x00000000064C1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2012-4812-0x0000000003680000-0x0000000003681000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2012-4814-0x0000000007EF0000-0x0000000007EF1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2012-4815-0x00000000064E0000-0x00000000064E1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2012-4816-0x00000000021B0000-0x0000000002251000-memory.dmp
    Filesize

    644KB

    Download
  • memory/2012-4820-0x0000000002CE0000-0x0000000002D16000-memory.dmp
    Filesize

    216KB

    Download
  • memory/2012-4830-0x0000000000400000-0x00000000006F9000-memory.dmp
    Filesize

    3.0MB

    Download