Analysis

  • max time kernel
    141s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    28-08-2023 08:27

General

  • Target

    61efe3f6a91e5c6ef31b9c27ced0a0e6f1de73fcf6487b70e1ce69133c0fd99a.exe

  • Size

    1.0MB

  • MD5

    48098be8e5ae8010664d2e006cdc8a8e

  • SHA1

    70e2042b9b3d52ddd133edd2e6c81f83f2ef0071

  • SHA256

    61efe3f6a91e5c6ef31b9c27ced0a0e6f1de73fcf6487b70e1ce69133c0fd99a

  • SHA512

    35fd1edcc721f4951dc14edf8ca00e0a9ef8558db599f56f735fb950cbf23de60e2a25ef58cb02ab6cfcaaa88707e8b3e2c2d5506ba34395203d27897d5e5d06

  • SSDEEP

    24576:hCXGqiuTPZ54YAFWd815T2M5SwMsA2740a388/YolI5hMJWVY:sXGqiu3EFnP2LcA2va388AiI5

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 6 IoCs
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 1 IoCs
  • UPX packed file 19 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61efe3f6a91e5c6ef31b9c27ced0a0e6f1de73fcf6487b70e1ce69133c0fd99a.exe
    "C:\Users\Admin\AppData\Local\Temp\61efe3f6a91e5c6ef31b9c27ced0a0e6f1de73fcf6487b70e1ce69133c0fd99a.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2044
      • C:\Windows\SysWOW64\explorer.exe
        explorer.exe
        3⤵
          PID:2808
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 588
        2⤵
        • Program crash
        PID:596

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\ExuiKrnln.dll

      Filesize

      328KB

      MD5

      6b0c10b774ee6dbcf0e4bd1557e7160b

      SHA1

      98e5502f0cb27e355062e8fa0b9aad80e5c0bbad

      SHA256

      335722b2684ffeac668ed8e9d7d582a395f9fc3d13f552f07c5d3ec7f025890f

      SHA512

      a44729fad75a090e4b3a0a4211ded10ef8ec499a7479efd2e3e6c448a3c625073b88e9e2c63c943f2fbcd9605aa9cc3cb1176a2ad61d91f22c4116948d66decf

    • \Windows\SysWOW64\ExuiKrnln.dll

      Filesize

      328KB

      MD5

      6b0c10b774ee6dbcf0e4bd1557e7160b

      SHA1

      98e5502f0cb27e355062e8fa0b9aad80e5c0bbad

      SHA256

      335722b2684ffeac668ed8e9d7d582a395f9fc3d13f552f07c5d3ec7f025890f

      SHA512

      a44729fad75a090e4b3a0a4211ded10ef8ec499a7479efd2e3e6c448a3c625073b88e9e2c63c943f2fbcd9605aa9cc3cb1176a2ad61d91f22c4116948d66decf

    • memory/2044-18-0x0000000000400000-0x00000000007FC000-memory.dmp

      Filesize

      4.0MB

    • memory/2044-19-0x0000000000400000-0x00000000007FC000-memory.dmp

      Filesize

      4.0MB

    • memory/2044-10-0x0000000000400000-0x00000000007FC000-memory.dmp

      Filesize

      4.0MB

    • memory/2044-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2044-16-0x0000000000400000-0x00000000007FC000-memory.dmp

      Filesize

      4.0MB

    • memory/2044-17-0x0000000000400000-0x00000000007FC000-memory.dmp

      Filesize

      4.0MB

    • memory/2044-41-0x0000000074E00000-0x0000000074F0B000-memory.dmp

      Filesize

      1.0MB

    • memory/2044-7-0x0000000000400000-0x00000000007FC000-memory.dmp

      Filesize

      4.0MB

    • memory/2044-20-0x0000000000400000-0x00000000007FC000-memory.dmp

      Filesize

      4.0MB

    • memory/2044-4-0x0000000000400000-0x00000000007FC000-memory.dmp

      Filesize

      4.0MB

    • memory/2044-23-0x0000000074E00000-0x0000000074F0B000-memory.dmp

      Filesize

      1.0MB

    • memory/2044-2-0x0000000000400000-0x00000000007FC000-memory.dmp

      Filesize

      4.0MB

    • memory/2044-71-0x0000000074E00000-0x0000000074F0B000-memory.dmp

      Filesize

      1.0MB

    • memory/2044-57-0x0000000074E00000-0x0000000074F0B000-memory.dmp

      Filesize

      1.0MB

    • memory/2044-43-0x0000000074E00000-0x0000000074F0B000-memory.dmp

      Filesize

      1.0MB

    • memory/2044-42-0x0000000000400000-0x00000000007FC000-memory.dmp

      Filesize

      4.0MB

    • memory/2376-39-0x0000000000400000-0x00000000007FC000-memory.dmp

      Filesize

      4.0MB

    • memory/2376-0-0x0000000000400000-0x00000000007FC000-memory.dmp

      Filesize

      4.0MB

    • memory/2376-44-0x0000000000400000-0x00000000007FC000-memory.dmp

      Filesize

      4.0MB

    • memory/2808-34-0x0000000001000000-0x0000000001281000-memory.dmp

      Filesize

      2.5MB

    • memory/2808-38-0x0000000001000000-0x0000000001281000-memory.dmp

      Filesize

      2.5MB

    • memory/2808-32-0x0000000001000000-0x0000000001281000-memory.dmp

      Filesize

      2.5MB

    • memory/2808-30-0x0000000001000000-0x0000000001281000-memory.dmp

      Filesize

      2.5MB

    • memory/2808-28-0x0000000001000000-0x0000000001281000-memory.dmp

      Filesize

      2.5MB

    • memory/2808-26-0x0000000001000000-0x0000000001281000-memory.dmp

      Filesize

      2.5MB

    • memory/2808-24-0x0000000001000000-0x0000000001281000-memory.dmp

      Filesize

      2.5MB