Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
09/10/2023, 06:37
General
-
Target
9e0323ee7dd5bf416356616cc20ff2fe8e93be176675af1b7d74a4a4c40e243b.exe
-
Size
4.5MB
-
MD5
c444260349caeda4df47142ba374b7b1
-
SHA1
59383a971f96239cf09aba54f4ea51be3b15f987
-
SHA256
9e0323ee7dd5bf416356616cc20ff2fe8e93be176675af1b7d74a4a4c40e243b
-
SHA512
52ccecda14cb8fa339642fa5f20f730ebfed9bf1dc95718d140042f63b3d249f1bef0c7a14cea1bfcff2d47f047cb5fc36637ab0ef2b69db155184f02d446f07
-
SSDEEP
49152:0uWYmjXcvDgYGERUAhZjNGlY+/bM/dPy+cT/8ks22ur9tpaGADCjSkAl2+XFCU4I:7kXcvDXGsUgG1/Q/g+ZmiPDC+kAEy4
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e0323ee7dd5bf416356616cc20ff2fe8e93be176675af1b7d74a4a4c40e243b.exe"C:\Users\Admin\AppData\Local\Temp\9e0323ee7dd5bf416356616cc20ff2fe8e93be176675af1b7d74a4a4c40e243b.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
111B
MD5750d1e62d281091d5120890a82eb2542
SHA1159dbe6b56d8f9fd6457d4c3f4d5bdcd58078c28
SHA256e478f0b3c195f14daaf4982550f0d68ca64f12588ee993c9d1644effc095233e
SHA512100497c5d8d05fdff91a905f6836597131f4b3bda303f6e63b7ab894b9a5da1a77320357ce8fb56237ca6f966fc60153df2a3ab7ed0924ec3f15ff8b580daa5e
-
Filesize
356KB
-
Filesize
960KB
-
Filesize
104KB
-
Filesize
960KB
-
Filesize
720KB
-
Filesize
960KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
104KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
720KB
-
Filesize
4KB