Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
16/10/2023, 13:17
General
-
Target
cb85e2e646f182f9ee1f1465aef6d31c2e53d0fd5ba43a31119ec1fe802e6cfc.exe
-
Size
3.4MB
-
MD5
bb909942e40f03885dcfb532fd46b345
-
SHA1
60ecd4629e8c6d55d74fe3ac3c7a0be888cdb3bb
-
SHA256
cb85e2e646f182f9ee1f1465aef6d31c2e53d0fd5ba43a31119ec1fe802e6cfc
-
SHA512
7a626abafb5e509e35de24461746125a5a8eaad2ef943f3b63b16b70707f426d8416b8e5d8978e5baf51fb276e6db576c78149e7121cdf2c8e1238755c5c8bdb
-
SSDEEP
98304:o3yEMCSpHX0QstYMi2kGI7UrCpoGj6c7gn82Ywt:VEM/pQtYX2kDQWow68uYwt
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 3 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb85e2e646f182f9ee1f1465aef6d31c2e53d0fd5ba43a31119ec1fe802e6cfc.exe"C:\Users\Admin\AppData\Local\Temp\cb85e2e646f182f9ee1f1465aef6d31c2e53d0fd5ba43a31119ec1fe802e6cfc.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
177KB
MD5f581898b2ff51c2ccca11993b693c628
SHA1f3477f50a088579c7d132e7846848b4196b4f488
SHA2564f612169a241a06e8a910fe2ecad6190e0958da0128d29b335064e68611aa26f
SHA51208bb46a2cbcf8afd4222f57cc92cf10defb2639e850b7043cb3ccf5f67546567069004e31205ae9f8c52fe9816a3c6963b96b946121fc500c89925246de43294
-
Filesize
177KB
MD5f581898b2ff51c2ccca11993b693c628
SHA1f3477f50a088579c7d132e7846848b4196b4f488
SHA2564f612169a241a06e8a910fe2ecad6190e0958da0128d29b335064e68611aa26f
SHA51208bb46a2cbcf8afd4222f57cc92cf10defb2639e850b7043cb3ccf5f67546567069004e31205ae9f8c52fe9816a3c6963b96b946121fc500c89925246de43294
-
Filesize
177KB
MD5f581898b2ff51c2ccca11993b693c628
SHA1f3477f50a088579c7d132e7846848b4196b4f488
SHA2564f612169a241a06e8a910fe2ecad6190e0958da0128d29b335064e68611aa26f
SHA51208bb46a2cbcf8afd4222f57cc92cf10defb2639e850b7043cb3ccf5f67546567069004e31205ae9f8c52fe9816a3c6963b96b946121fc500c89925246de43294
-
Filesize
124KB
-
Filesize
488KB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
748KB
-
Filesize
124KB
-
Filesize
4.6MB
-
Filesize
124KB
-
Filesize
4.6MB
-
Filesize
1.6MB
-
Filesize
200KB
-
Filesize
2.1MB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
4.6MB
-
Filesize
748KB
-
Filesize
124KB
-
Filesize
960KB
-
Filesize
960KB