Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
16/10/2023, 11:07
General
-
Target
c357a178be134b5538847a5440d90bd76530d9adbc4c09e9792fc60095dcb2a0.exe
-
Size
3.6MB
-
MD5
1e36485b4c5aaaec60a5705e8f92c016
-
SHA1
b1910bcaf49d35ea3fe661baf1b65cde5d1c7b30
-
SHA256
c357a178be134b5538847a5440d90bd76530d9adbc4c09e9792fc60095dcb2a0
-
SHA512
e95f719059b79d70f2036adc5f72bd57765598a7a9fb847c10419847968e837805af7e16a781a71a1a748b82069f2b7e19e04fbbe1d7eb17cd33a1aa74a725ca
-
SSDEEP
49152:cdQzwBd7PTARzYmg8fhc+Sa3Tz53wJWqb2N6:AL7PcRzRgohTSa3vEON6
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 5 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c357a178be134b5538847a5440d90bd76530d9adbc4c09e9792fc60095dcb2a0.exe"C:\Users\Admin\AppData\Local\Temp\c357a178be134b5538847a5440d90bd76530d9adbc4c09e9792fc60095dcb2a0.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
100KB
-
Filesize
3.9MB