Analysis
-
max time kernel
61s -
max time network
67s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
11-06-2023 02:22
General
-
Target
cWXfv4LPZzqnwdFjgkZExVhaMZJewilrvuOQxYzt.exe
-
Size
146KB
-
MD5
c789a3a89d17ab41fa660c3f59f376d4
-
SHA1
eba0b3e7b3a76a23132cee507061f6987abe3137
-
SHA256
91fa268b81a58456c39e93b97edf93d337211e3f2e6f5c74b953f4cb6776aa27
-
SHA512
3aee37a638856e92b732ef923afa8ce4a7836555ba1f0159d9b23a8a72f2809bf3aad73f412d00b162403c5cfd0e75e4ee33b6eb4079aa0eefc83aa595e143c8
-
SSDEEP
3072:SNsrb3QnnOxoxYGYn8C4zIB2eBH6CaucLD1kkQIpEH5xsXFHzZpbWjRBLFk/Pout:qsX3QnM8CDwgDcLxQI+ZxkHzf2RB2/PZ
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cWXfv4LPZzqnwdFjgkZExVhaMZJewilrvuOQxYzt.exe"C:\Users\Admin\AppData\Local\Temp\cWXfv4LPZzqnwdFjgkZExVhaMZJewilrvuOQxYzt.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
660KB
-
Filesize
660KB