Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
12/10/2023, 11:24
General
-
Target
95402a7963d43979e500d1c5b4c7f2f4ce044365bba0d179b518a6e223232322.exe
-
Size
5.3MB
-
MD5
45387c4a6ba7391660d6bc2536b7bda7
-
SHA1
6fe408687b0472d8c98bf4c98459da243b019c78
-
SHA256
95402a7963d43979e500d1c5b4c7f2f4ce044365bba0d179b518a6e223232322
-
SHA512
ee9787eb1168de99693281e1c7bae860f81350a41a9df50cce5cf64a208ca091160876c042389f52065b1268164d534eed20d62f9f6776fbc535bfe6f5943984
-
SSDEEP
49152:RzbFSZ+5hGBcFLbWf3SFkbn0DRcdczEG6VisMXz53wJWqb2NA:RPkZSwBcFLM+kb0DidUEG6VisMDEONA
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 7 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\95402a7963d43979e500d1c5b4c7f2f4ce044365bba0d179b518a6e223232322.exe"C:\Users\Admin\AppData\Local\Temp\95402a7963d43979e500d1c5b4c7f2f4ce044365bba0d179b518a6e223232322.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
100KB
-
Filesize
5.5MB
-
Filesize
5.5MB