Analysis
-
max time kernel
203s -
max time network
200s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
12/10/2023, 05:53
General
-
Target
45c71780462d5f198c14f2fff5e0b6deef1e7212aa1531ed134781e6ef3f2453.exe
-
Size
14.2MB
-
MD5
1610513f677306b8c6b4039b5ae3fadc
-
SHA1
f67ea317b0e8b36ad284e9536b80ca6913633d3d
-
SHA256
45c71780462d5f198c14f2fff5e0b6deef1e7212aa1531ed134781e6ef3f2453
-
SHA512
508118bcc99afa87bb22b548645dd0c2e2782b5d00535aa727fe7d5f41e23c90a6c12fbdcd8968136f5ec20e12eea8d2bd5e6f4545e8279242d025ec17523b52
-
SSDEEP
393216:MpgGC5K8qO4QJ4KRuqy3RukNZgvqzVRBgGY:Kkj/ZYlgC54l
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\45c71780462d5f198c14f2fff5e0b6deef1e7212aa1531ed134781e6ef3f2453.exe"C:\Users\Admin\AppData\Local\Temp\45c71780462d5f198c14f2fff5e0b6deef1e7212aa1531ed134781e6ef3f2453.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5733addd0bb479e49e25452fde2cff901
SHA1e7a8c8b916423420dbf01a9f1924ef7a6001c43e
SHA256880857ae1b56535a2efa32a4daf876e6606805a14e9038e0fdc7b9c36fa2184e
SHA512f814773d26744cd6e408358af04b583281d5e228cc0fe00d3eacfcd8375701204b7e0093ffc4915ddcce3fd7b4ea2910cf0a2b8624d42f55cfe899b8abb3cc3e
-
Filesize
312KB
MD5460985cd6e19695e691a6acc9351d80b
SHA10a15fa4d9b2a8323df23e650a283076e5833afea
SHA256b559b21adf327c570dde6a0faebad5758a4e2bdb2f9d332b6e143f4f949a1c16
SHA512aba1ccb125b3d39f7d8d8fd091d5423671e3a87e21d6ec3f2cb8a76addea70a3521c5b5e1eac7df798ebe9d33029e43dac5f1d6e72a8cda7a010f9fe9ee3491b
-
Filesize
4KB
-
Filesize
1008KB
-
Filesize
4KB
-
Filesize
27.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
27.7MB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
1008KB
-
Filesize
27.7MB
-
Filesize
4KB
-
Filesize
1008KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
27.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB