Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
31/10/2023, 08:54
General
-
Target
NEAS.73ec55003c9cfcffe7abb285a979b150.exe
-
Size
374KB
-
MD5
73ec55003c9cfcffe7abb285a979b150
-
SHA1
dd6366166922e4a7656271ebc8793b3edcf664f7
-
SHA256
a38d5346d345fc6c2654281bd517e787180472b6cc5154fd97624c03040c9557
-
SHA512
f4cc5672d5d66b4fbaaf001990747a0df64cbcfa9d52756c728f672f639da5b5fd6d868dc0e9de91475129ecbed857da150abc76ee965f8a1301a59a8a4a8cd3
-
SSDEEP
3072:hZ+srvy+8+ANlhKeNPBJraHIL1c0gxQD9aXjsaouRIXMz+rpGbnb2HJ9+UuBx8t:hZrK+r+l0eNPBJrOxQD90saoTXrGsvgS
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 3 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.73ec55003c9cfcffe7abb285a979b150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.73ec55003c9cfcffe7abb285a979b150.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Syslemiokns.exe"C:\Users\Admin\AppData\Local\Temp\Syslemiokns.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
374KB
MD526b686095274c87cbbbfd3eb1d8ac57f
SHA19aca3e5c8a58722a5c9c0de927f8ea06335f2a0b
SHA2566d611cc1feb4e7914dfab63952c6475acc394085d5c319c985f8271c9e96bed8
SHA5125842088b11fcf3ad685ffbc00a2ebff568d51b2be423528130c5e7d8b6a64625950941bc3db8a233e70c16d71e7b53d3d8587a3871f51fe8e544d73619f5f561
-
Filesize
374KB
MD526b686095274c87cbbbfd3eb1d8ac57f
SHA19aca3e5c8a58722a5c9c0de927f8ea06335f2a0b
SHA2566d611cc1feb4e7914dfab63952c6475acc394085d5c319c985f8271c9e96bed8
SHA5125842088b11fcf3ad685ffbc00a2ebff568d51b2be423528130c5e7d8b6a64625950941bc3db8a233e70c16d71e7b53d3d8587a3871f51fe8e544d73619f5f561
-
Filesize
374KB
MD526b686095274c87cbbbfd3eb1d8ac57f
SHA19aca3e5c8a58722a5c9c0de927f8ea06335f2a0b
SHA2566d611cc1feb4e7914dfab63952c6475acc394085d5c319c985f8271c9e96bed8
SHA5125842088b11fcf3ad685ffbc00a2ebff568d51b2be423528130c5e7d8b6a64625950941bc3db8a233e70c16d71e7b53d3d8587a3871f51fe8e544d73619f5f561
-
Filesize
75B
MD54ec6f7fb61f11d3c00342a8ec8c7d830
SHA158e7f45b9c72c2805f9835fa87e661c0f93ee218
SHA2563289f7a5472c68645a54f2ffe9bfe3906818f9d67f20388d652beedca4fc93be
SHA5122264328bc950be19fdc1c9835a390220ed5690b1f422c9abd9c46467ca5f6086c5fa72d9808d6e93ae83dbb3b680678da238d3901e3fa9627616f17be7c10e75