Analysis
-
max time kernel
133s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
23/10/2023, 17:38
General
-
Target
c94f3e205c747ea3238c6aeb6fab6972af50a332af242b2aa02ef689ec269f8b.exe
-
Size
1.3MB
-
MD5
4f6be8b0a37123f64dc6c5c64d3ac731
-
SHA1
3cc764ed720c10ca1f35f2c15e64c58b054788e0
-
SHA256
c94f3e205c747ea3238c6aeb6fab6972af50a332af242b2aa02ef689ec269f8b
-
SHA512
ff559524ae0ad1f5a7385db97cf2ef0b44a9b8b328056f879f7b0f3566d38df04864e25d7c099ac1e0bbf00bb42034a59f60c9486548f17838ac47dad08d0904
-
SSDEEP
24576:DkACnTTsXcJu1VUY4fA8sycIht2J14/4aoy13CDIMwZZgV0rtJynfBX4W:Dx1VUYd8DcI3gao4SDk3tJyfB
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 1 IoCs
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c94f3e205c747ea3238c6aeb6fab6972af50a332af242b2aa02ef689ec269f8b.exe"C:\Users\Admin\AppData\Local\Temp\c94f3e205c747ea3238c6aeb6fab6972af50a332af242b2aa02ef689ec269f8b.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c94f3e205c747ea3238c6aeb6fab6972af50a332af242b2aa02ef689ec269f8b.exeTY433A5C50726F6772616D446174615C4369747269785C6B6B64786572797079676B706E686E667A71716B6C646B5C6971666A687A7277707A7A6573716C6A2E6578652⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c94f3e205c747ea3238c6aeb6fab6972af50a332af242b2aa02ef689ec269f8b.exeKL433A5C50726F6772616D446174615C4369747269785C6B6B64786572797079676B706E686E667A71716B6C646B5C6971666A687A7277707A7A6573716C6A2E6578653⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start C:\ProgramData\Citrix\kkdxerypygkpnhnfzqqkldk\iqfjhzrwpzzesqlj.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Citrix\kkdxerypygkpnhnfzqqkldk\iqfjhzrwpzzesqlj.exeC:\ProgramData\Citrix\kkdxerypygkpnhnfzqqkldk\iqfjhzrwpzzesqlj.exe5⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
744KB
MD5d9af52f6ba09088b0c6d40e84dd7e87d
SHA1178fbd173d5a64ca7b04f7c2f146d963b8ef0501
SHA256478b311e7397ef5db4d789e5af3f729558e8eb7afaba49b4d45b789a6ec0ecc9
SHA51264dffe73611881dc08576752364fe577aab70a0a306f90645a5dec16ea86dab85a90aa5a5693b32b40d05b14cd55ee865cfdab5bb28411d42f7a874bacf610bd
-
Filesize
125KB
MD58929530afda63d45859ecbabc5e9edb4
SHA17f8a88b9d815399ee0047f8bc67c7a2a1d7c16bd
SHA256f4f76935e15ae533d47434880b455297a7b57bd45cd98e124eabf4cfe5b24723
SHA512fae7e1027de3ece5ad06b24ead5c07912c0b5c6217677d2702ebec49c968c7a6f3feffb73491a1557878c6cc5cc69045bc818abc71a48c5a2408f1359f9bd583
-
Filesize
1.5MB
-
Filesize
4KB
-
Filesize
932KB
-
Filesize
2.1MB
-
Filesize
932KB
-
Filesize
344KB
-
Filesize
940KB
-
Filesize
612KB
-
Filesize
932KB
-
Filesize
328KB
-
Filesize
1.5MB
-
Filesize
932KB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
328KB
-
Filesize
344KB
-
Filesize
612KB
-
Filesize
940KB
-
Filesize
1.5MB
-
Filesize
328KB