Overview

overview

10

Static

static

10

fc0ecc2e1c...JC.exe

windows7-x64

10

fc0ecc2e1c...JC.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    153s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    19-07-2023 17:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fc0ecc2e1c3bf6exe_JC.exe

  • Size

    11.4MB

  • MD5

    fc0ecc2e1c3bf6ef324b7b35349ff92d

  • SHA1

    9671b493f0ad6065a8e74467de09065147172cd1

  • SHA256

    7732fc8fac77340ac22d1e0a71bcfc44f9d41391f5a0844b30643fc1f48c3546

  • SHA512

    1d4ed2cbea3b000f223012f63ef2cac7a9f63362ce18356b10ad31ec1553cfc20b7d2c117a093bb98d575930d84198f2d79cfd12a28451fa4f01ee84445c9be5

  • SSDEEP

    196608:s7R2gfB1NHqDXJqNjLPEWyZ/K0ttYVAATDBEMP:sFt1NHqbJYvyZ/K0ttYZTDB

Score
10/10
blackmoonbankerevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon
  • Detect Blackmoon payload 6 IoCs
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Adds policy Run key to start application 2 TTPs 1 IoCs
    persistence
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops autorun.inf file 1 TTPs 6 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\fc0ecc2e1c3bf6exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\fc0ecc2e1c3bf6exe_JC.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:788
    • C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe
      "C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"
      2⤵
      • UAC bypass
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2552

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe
    Filesize

    11.4MB

    MD5

    fc0ecc2e1c3bf6ef324b7b35349ff92d

    SHA1

    9671b493f0ad6065a8e74467de09065147172cd1

    SHA256

    7732fc8fac77340ac22d1e0a71bcfc44f9d41391f5a0844b30643fc1f48c3546

    SHA512

    1d4ed2cbea3b000f223012f63ef2cac7a9f63362ce18356b10ad31ec1553cfc20b7d2c117a093bb98d575930d84198f2d79cfd12a28451fa4f01ee84445c9be5

    Download Submit

  • C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe
    Filesize

    11.4MB

    MD5

    fc0ecc2e1c3bf6ef324b7b35349ff92d

    SHA1

    9671b493f0ad6065a8e74467de09065147172cd1

    SHA256

    7732fc8fac77340ac22d1e0a71bcfc44f9d41391f5a0844b30643fc1f48c3546

    SHA512

    1d4ed2cbea3b000f223012f63ef2cac7a9f63362ce18356b10ad31ec1553cfc20b7d2c117a093bb98d575930d84198f2d79cfd12a28451fa4f01ee84445c9be5

    Download Submit

  • C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe
    Filesize

    11.4MB

    MD5

    fc0ecc2e1c3bf6ef324b7b35349ff92d

    SHA1

    9671b493f0ad6065a8e74467de09065147172cd1

    SHA256

    7732fc8fac77340ac22d1e0a71bcfc44f9d41391f5a0844b30643fc1f48c3546

    SHA512

    1d4ed2cbea3b000f223012f63ef2cac7a9f63362ce18356b10ad31ec1553cfc20b7d2c117a093bb98d575930d84198f2d79cfd12a28451fa4f01ee84445c9be5

    Download Submit

  • \Windows\360\360Safe\deepscan\ZhuDongFangYu.exe
    Filesize

    11.4MB

    MD5

    fc0ecc2e1c3bf6ef324b7b35349ff92d

    SHA1

    9671b493f0ad6065a8e74467de09065147172cd1

    SHA256

    7732fc8fac77340ac22d1e0a71bcfc44f9d41391f5a0844b30643fc1f48c3546

    SHA512

    1d4ed2cbea3b000f223012f63ef2cac7a9f63362ce18356b10ad31ec1553cfc20b7d2c117a093bb98d575930d84198f2d79cfd12a28451fa4f01ee84445c9be5

    Download Submit

  • \Windows\360\360Safe\deepscan\ZhuDongFangYu.exe
    Filesize

    11.4MB

    MD5

    fc0ecc2e1c3bf6ef324b7b35349ff92d

    SHA1

    9671b493f0ad6065a8e74467de09065147172cd1

    SHA256

    7732fc8fac77340ac22d1e0a71bcfc44f9d41391f5a0844b30643fc1f48c3546

    SHA512

    1d4ed2cbea3b000f223012f63ef2cac7a9f63362ce18356b10ad31ec1553cfc20b7d2c117a093bb98d575930d84198f2d79cfd12a28451fa4f01ee84445c9be5

    Download Submit

  • memory/788-54-0x0000000000400000-0x000000000044D000-memory.dmp

    Filesize

    308KB

    Download