Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
17/08/2023, 20:44
General
-
Target
1c6f5555e230665b1554917f77ca327f4e1042c4a002f167d54ec9fd59de2ff2.exe
-
Size
1.1MB
-
MD5
cedef2198314d2176a960f9417a0d157
-
SHA1
b3967238bd600e9f1e7bf05b28932b74bb010b63
-
SHA256
1c6f5555e230665b1554917f77ca327f4e1042c4a002f167d54ec9fd59de2ff2
-
SHA512
7c0bb9281d2949f9668edaa4095a0c1963386d6d11e737b8def12b30f39bc76325fd73a54ecea5026c8582e23d7c4a30506b9a9dc4b78e226a0d722bb054e508
-
SSDEEP
12288:c4ahKhHAC83UAzQzWXvibmWWsJMkwnkx:c4L83hz7E9JM
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 9 IoCs
-
Gh0st RAT payload 3 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Modifies registry class 1 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c6f5555e230665b1554917f77ca327f4e1042c4a002f167d54ec9fd59de2ff2.exe"C:\Users\Admin\AppData\Local\Temp\1c6f5555e230665b1554917f77ca327f4e1042c4a002f167d54ec9fd59de2ff2.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Music\1c6f5555e230665b1554917f77ca327f4e1042c4a002f167d54ec9fd59de2ff2.exe"C:\Users\Public\Music\1c6f5555e230665b1554917f77ca327f4e1042c4a002f167d54ec9fd59de2ff2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\1c6f5555e230665b1554917f77ca327f4e1042c4a002f167d54ec9fd59de2ff2.txt3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 20043⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1816 -ip 18161⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120KB
MD53aea5b78bac5359a799c2714fecccd1a
SHA15d3203b328ecfc7a55c0ded1032d209e9f273367
SHA256c05e763cab67cf9daf5be7a6a6cff2650223987a9693eaa119f69b2bbb6df6c3
SHA5129513cc84a7ed3dd709d4affb03f6e286dcd43e82f33441c00a9d74d2b45449f2ee20baa8db46218d7a59d9e62fb7f95050ea305166e70f3e71dde39ccf07b6d3
-
Filesize
2KB
MD57943effe67a4647e06def2348949020e
SHA1eabd561f0639a975de259633f63896d82c3f878d
SHA2563fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa
SHA512c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003
-
Filesize
2KB
MD57943effe67a4647e06def2348949020e
SHA1eabd561f0639a975de259633f63896d82c3f878d
SHA2563fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa
SHA512c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003
-
Filesize
236B
MD571aef9eff6e593fae92b569a5087a0b1
SHA1bce1fbc27f2859b84adb65170b7b64b7819fd513
SHA25622f8bbe0f5d42364ec33ec2f3c42049745ed48239e02c59b7350b1b832960117
SHA512e3eaeb952fc3b0ba3e9020ddfb1cac867222c7f15b5cd1ca382e4bd531a1c454d2e4f6625ac574f18d7f7cc70c6444034d957cadfb80472374645139d8016db6
-
Filesize
66KB
MD5c3c4cbb47750c94dbb081fb609d92521
SHA1424f6c64ee8911cf48036690a50b286f80f3dc54
SHA25654250ff265be2255040ffa327a5cc58a9a95d9f477ab5c1d10f01c7081aed708
SHA512d3d33e3c9cfd87d9a06f15e173c4eee5c31ef4e5daed27daa1b86a0b55de34eaf3fb82ab8b00ada165613419e529465b0b48bfd0b85da2f8b079ec2c6aa61f01
-
Filesize
2KB
MD57943effe67a4647e06def2348949020e
SHA1eabd561f0639a975de259633f63896d82c3f878d
SHA2563fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa
SHA512c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003
-
Filesize
1.1MB
MD5cedef2198314d2176a960f9417a0d157
SHA1b3967238bd600e9f1e7bf05b28932b74bb010b63
SHA2561c6f5555e230665b1554917f77ca327f4e1042c4a002f167d54ec9fd59de2ff2
SHA5127c0bb9281d2949f9668edaa4095a0c1963386d6d11e737b8def12b30f39bc76325fd73a54ecea5026c8582e23d7c4a30506b9a9dc4b78e226a0d722bb054e508
-
Filesize
1.1MB
MD5cedef2198314d2176a960f9417a0d157
SHA1b3967238bd600e9f1e7bf05b28932b74bb010b63
SHA2561c6f5555e230665b1554917f77ca327f4e1042c4a002f167d54ec9fd59de2ff2
SHA5127c0bb9281d2949f9668edaa4095a0c1963386d6d11e737b8def12b30f39bc76325fd73a54ecea5026c8582e23d7c4a30506b9a9dc4b78e226a0d722bb054e508
-
Filesize
1.1MB
MD5cedef2198314d2176a960f9417a0d157
SHA1b3967238bd600e9f1e7bf05b28932b74bb010b63
SHA2561c6f5555e230665b1554917f77ca327f4e1042c4a002f167d54ec9fd59de2ff2
SHA5127c0bb9281d2949f9668edaa4095a0c1963386d6d11e737b8def12b30f39bc76325fd73a54ecea5026c8582e23d7c4a30506b9a9dc4b78e226a0d722bb054e508
-
Filesize
120KB
MD53aea5b78bac5359a799c2714fecccd1a
SHA15d3203b328ecfc7a55c0ded1032d209e9f273367
SHA256c05e763cab67cf9daf5be7a6a6cff2650223987a9693eaa119f69b2bbb6df6c3
SHA5129513cc84a7ed3dd709d4affb03f6e286dcd43e82f33441c00a9d74d2b45449f2ee20baa8db46218d7a59d9e62fb7f95050ea305166e70f3e71dde39ccf07b6d3
-
Filesize
972KB
-
Filesize
972KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
12KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
12KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
2.3MB
-
Filesize
160KB
-
Filesize
12KB
-
Filesize
972KB
-
Filesize
252KB
-
Filesize
160KB
-
Filesize
412KB
-
Filesize
160KB
-
Filesize
92KB
-
Filesize
56KB
-
Filesize
160KB
-
Filesize
12KB
-
Filesize
412KB
-
Filesize
2.3MB
-
Filesize
12KB
-
Filesize
2.3MB
-
Filesize
12KB