Analysis
-
max time kernel
160s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
03/11/2023, 15:59
General
-
Target
5f39daa7e0bbce80fd66b9cefde88032eb8a14d2e98a7031c2c849ab22fa5d3f.exe
-
Size
856KB
-
MD5
d56cec5f847a4e075d05925560dac182
-
SHA1
fb666c645575960cda418cd4f3662865099a05df
-
SHA256
5f39daa7e0bbce80fd66b9cefde88032eb8a14d2e98a7031c2c849ab22fa5d3f
-
SHA512
4b3375b43b4b9f0545724f6269df8aa6fb740e28d8c400f2e45ae743a921a7d006c722e02c46536c29c86997cc3f5d2e4d3788bb11cc3eff671ec36abc72680b
-
SSDEEP
24576:OFs9imJumWV/rAP8MgA7NWLaHRieR0pB/wG:70muMlgA7NiaHRieGpB/T
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 6 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f39daa7e0bbce80fd66b9cefde88032eb8a14d2e98a7031c2c849ab22fa5d3f.exe"C:\Users\Admin\AppData\Local\Temp\5f39daa7e0bbce80fd66b9cefde88032eb8a14d2e98a7031c2c849ab22fa5d3f.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
660KB
MD5edb2ae3f3a41f5e9939ab13b14231049
SHA1dd72537627466033192d6ff3a7c65c515cf6df31
SHA256d470bea39a4d942afe3789a4d8d90f6152b00b5bb2cc3f1bcff013da7cbaf061
SHA51235f777e97fed4b082f64f288f0b822c7a57d09176bf5ba7bdfe2e9b2dc8444302451019e77c0b8c950c01389f56acc1216da1d88ca089694ba58103af06c2b8c
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.5MB
-
Filesize
4KB
-
Filesize
2.5MB