Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
26/08/2023, 15:50
General
-
Target
29bc4d3f7295b038e503bea1c2060155dbf74cdb1e41f2f749f3b88d8e212c3f.exe
-
Size
3.7MB
-
MD5
7f450bb9385430f0e23168849a2106ff
-
SHA1
fae8593c146d6766bff1e7d6cdd0869170e27441
-
SHA256
29bc4d3f7295b038e503bea1c2060155dbf74cdb1e41f2f749f3b88d8e212c3f
-
SHA512
f6aa3abdd62b3af4bb7567caab6f014a9b2b0ce489327ae577117f76fc72236d8e02c19ccdb90e63866af4697047c277dd17250b4a8907fb9f5cdb6a9948abb9
-
SSDEEP
98304:drx6wj1VjsAxUwh0qklTyq4FSmnZBXSHGQo:ek1RnhklTt40m7XSHGR
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 22 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\29bc4d3f7295b038e503bea1c2060155dbf74cdb1e41f2f749f3b88d8e212c3f.exe"C:\Users\Admin\AppData\Local\Temp\29bc4d3f7295b038e503bea1c2060155dbf74cdb1e41f2f749f3b88d8e212c3f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Çå·ç΢¶Ë[3].exe"C:\Users\Admin\AppData\Local\Temp\Çå·ç΢¶Ë[3].exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD5eb94898dd72051b7845dcc3acde0dd6f
SHA1cf1d2694c40b37006e35f38f2b89b190e7d57180
SHA25651763059acfc0d8551da1143cbc0383dd2c552c152d820c5dd039e0b884e5993
SHA5129ababd6efd502a6a0d0bf3a28d5f94b0c6034d25a44babb272f14e2a906800b26959171949c2786684f4b78560f42b108b34d05157c01ca4558ac7efaee63b7d
-
Filesize
44KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
44KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
160KB
-
Filesize
1.1MB
-
Filesize
72KB
-
Filesize
1.1MB
-
Filesize
72KB
-
Filesize
1.1MB
-
Filesize
160KB
-
Filesize
44KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
160KB
-
Filesize
1.1MB
-
Filesize
72KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
44KB
-
Filesize
1.1MB
-
Filesize
72KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB