Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
18/08/2023, 20:30
General
-
Target
8f47d47a9f2886fe63f02daf1d5cf96f84a19dffcefeed1ac61b86aaa176ad91.exe
-
Size
15.6MB
-
MD5
40c31d39a3763f3981b6635bb7ef5df9
-
SHA1
aa713e38709be8951f292c17356c16fda2bb0afc
-
SHA256
8f47d47a9f2886fe63f02daf1d5cf96f84a19dffcefeed1ac61b86aaa176ad91
-
SHA512
343ce7021b37e473cdab8ec49e7ee7b719c03afb653864793f2af9c3bb40c551e27020d39c397f9615cfac90c62ecacb3e08f9af547505ea979d3d596241b3da
-
SSDEEP
393216:MPz8K3m8+wsHVu/ZtGvv49W4up6c5ZQ9Tt+Yk/CUIh:6zD2Zwss/75W4tCe9AdI
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 16 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 35 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f47d47a9f2886fe63f02daf1d5cf96f84a19dffcefeed1ac61b86aaa176ad91.exe"C:\Users\Admin\AppData\Local\Temp\8f47d47a9f2886fe63f02daf1d5cf96f84a19dffcefeed1ac61b86aaa176ad91.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ħÊÞÊÀ½ç335µÇ¼Æ÷.exeC:\Users\Admin\AppData\Local\Temp\ħÊÞÊÀ½ç335µÇ¼Æ÷.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\wowloot.exeC:\Users\Admin\AppData\Local\Temp\wowloot.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\csrss.exeC:\Users\Admin\AppData\Roaming\csrss.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8B
MD57c5a0e753537dbf92ea88f3c72d44802
SHA1fb9edf4674f431394d41792b909d18b21402368b
SHA256580b8fa0536cc5ad8d53b297c042b0ee3ceef2b7e2097233779cabb595ce3f03
SHA512963bd5b127218a467f81e414d6548bdf3b8ba1bc8db58031263de7f91188a0b6ebe91e31a10a6c3140ce629359208aca03a9e9c1cbbd91cb964b0a253214c0e3
-
Filesize
396KB
MD507e027eeb5ca9036230daa786ba2a19a
SHA117e5654eae015ed57fb372fe5a053fda1c053788
SHA256eee99e8ba4276c4a2486d88841f086e2805b467c459d635affc9dea18e8dd7a4
SHA512837d8d3e5ad4ecd55f940856379033b950b7f5c25cbbac1d98a0426f848a05cbb85ed3c5409b4bab3bfa574c3e41b0ec1b4418425061f28f99efe997ac380984
-
Filesize
396KB
MD507e027eeb5ca9036230daa786ba2a19a
SHA117e5654eae015ed57fb372fe5a053fda1c053788
SHA256eee99e8ba4276c4a2486d88841f086e2805b467c459d635affc9dea18e8dd7a4
SHA512837d8d3e5ad4ecd55f940856379033b950b7f5c25cbbac1d98a0426f848a05cbb85ed3c5409b4bab3bfa574c3e41b0ec1b4418425061f28f99efe997ac380984
-
Filesize
680KB
MD5e4a3a7ec55e88daf9fcb40de38e832e1
SHA19c607242794a63b7136f1ee7b900fcdf7cf3985a
SHA2564ffea6b348d294817b98a4828159db0ebdda2490ff87fe969158daf56a056169
SHA5128112aca7a61eaf7bc8ed6bea0d5ef09b77db5d27c8c79bf70f3738bb1e321e3141a04f96eaddd57cbf63799eeacf1ac53c9e2b0842c11d97a464c68759932b4b
-
Filesize
680KB
MD5e4a3a7ec55e88daf9fcb40de38e832e1
SHA19c607242794a63b7136f1ee7b900fcdf7cf3985a
SHA2564ffea6b348d294817b98a4828159db0ebdda2490ff87fe969158daf56a056169
SHA5128112aca7a61eaf7bc8ed6bea0d5ef09b77db5d27c8c79bf70f3738bb1e321e3141a04f96eaddd57cbf63799eeacf1ac53c9e2b0842c11d97a464c68759932b4b
-
Filesize
12.9MB
MD527e4fdbc94e91fa4862865c211be10d6
SHA116d7a815d3625c2f4c9aeed082c7ebb81d031ebb
SHA25646649fa510a4c6aba86cc7e5252133f82b49c3e6c8a8323eb6767d6b57b891dd
SHA512a8eb0345bf7ac5395e6a57f0dadd2fa4edcb5bc0ee78366c242569dd258c8758ef260b0f73e78024bff061836694e75bc346de483a7e0f3ddbfdb3e3de602c57
-
Filesize
12.9MB
MD527e4fdbc94e91fa4862865c211be10d6
SHA116d7a815d3625c2f4c9aeed082c7ebb81d031ebb
SHA25646649fa510a4c6aba86cc7e5252133f82b49c3e6c8a8323eb6767d6b57b891dd
SHA512a8eb0345bf7ac5395e6a57f0dadd2fa4edcb5bc0ee78366c242569dd258c8758ef260b0f73e78024bff061836694e75bc346de483a7e0f3ddbfdb3e3de602c57
-
Filesize
63B
MD596a9e7ac3daed4483168543a7ccfd833
SHA154ad47ede89b74227dbf1fb0610715df4dd30765
SHA256eaff61a13e498e2c2668d797c8f273c81ccc0fad453b7e27dbf7f694b1fed324
SHA51285d23119bb8dac6ed6bc3ebc05abdeaf4d79c9eebd02205131195ff53b9f3b89418c7cce41b5ac2a5454d9f0d21a3af5fb845479d379e24ed24b799e127f751a
-
Filesize
428KB
MD5c4c7ee38882d321b805a700a14aab186
SHA1a70f5f3b5a80a961506b8534f1d6bb24f071e8f9
SHA25676a65443c94a6c9f287306aba9d86dda8a506f5d8ad74d35c0c4c85b049ecdae
SHA512212592a39d2a95280c8f6b322dd0e345cb0c23673ba6c77a981accde7212ad3dba251f237a8db660a48724bb789de092b4eeb1ad7423104f827973e6f20cc501
-
Filesize
428KB
MD5c4c7ee38882d321b805a700a14aab186
SHA1a70f5f3b5a80a961506b8534f1d6bb24f071e8f9
SHA25676a65443c94a6c9f287306aba9d86dda8a506f5d8ad74d35c0c4c85b049ecdae
SHA512212592a39d2a95280c8f6b322dd0e345cb0c23673ba6c77a981accde7212ad3dba251f237a8db660a48724bb789de092b4eeb1ad7423104f827973e6f20cc501
-
Filesize
4B
MD52b1905b5d4641830901acf76c957cfb1
SHA17f10f671d10f8076b8dcb0180ffb78d25605fdfe
SHA256a6ba1d32e2731f8c9a6a982bdbafa938784b1ceec04ab84f003740a323c0fc6b
SHA51210fc697b4802c2a40d75de17b879a74c496efe4becc6e88ff7eead6cd59cb2168d6693ea5087307bbb6a98c5d412d08e3a33c65fea54f8f3df7eaf199ff7160f
-
Filesize
4KB
-
Filesize
34.5MB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
34.5MB
-
Filesize
34.5MB
-
Filesize
34.5MB
-
Filesize
1.6MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
17.5MB
-
Filesize
17.5MB
-
Filesize
17.5MB
-
Filesize
17.5MB
-
Filesize
17.5MB
-
Filesize
17.5MB
-
Filesize
17.5MB
-
Filesize
17.5MB
-
Filesize
17.5MB
-
Filesize
17.5MB
-
Filesize
17.5MB
-
Filesize
17.5MB
-
Filesize
17.5MB
-
Filesize
17.5MB
-
Filesize
17.5MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB