Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
05/11/2023, 04:33
General
-
Target
NEAS.1e5e57747f3223647eed93baedcd4e70_JC.exe
-
Size
3.0MB
-
MD5
1e5e57747f3223647eed93baedcd4e70
-
SHA1
41d021b36272d89bf3f5a51a5c42600ceab5a2d9
-
SHA256
d3450195f893d7df66bfa051ef9bfea1859a7360749bbedd59567016d9abbe9f
-
SHA512
2bb4349321c19f5edfb1a86c941df1294c75152191ed18ce64c170e3a66c9395d48aee44faf45d3cd2e311b3944738ae5278b4c26746c080f9cb5369a02e8ff8
-
SSDEEP
49152:gUmJN8WOSElD+ff+PruHlHEIj9YX+BFBrzbIzmCFoqxmMONz0WuhzEYLXCGLcv7H:YJN8WOSE9+fMclH1YqBnbIzPKqjWoocw
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 22 IoCs
-
ASPack v2.12-2.42 2 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.1e5e57747f3223647eed93baedcd4e70_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.1e5e57747f3223647eed93baedcd4e70_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\genwangame\NEAS.1e5e57747f3223647eed93baedcd4e70_JC[ʵ]\NEAS.1e5e57747f3223647eed93baedcd4e70_JC[ʵ].exeC:\Users\Admin\AppData\Roaming\genwangame\NEAS.1e5e57747f3223647eed93baedcd4e70_JC[ʵ]\NEAS.1e5e57747f3223647eed93baedcd4e70_JC[ʵ].exe -t 3812 C:\Users\Admin\AppData\Local\Temp\NEAS.1e5e57747f3223647eed93baedcd4e70_JC.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
471B
MD500fea4a918e89eb400adb152f9b406d0
SHA117653a5dcaf8c90f968fac45a360df45ea1fdcdb
SHA25692697424b79a8c5ec1cbd62fb473bc9e85ae803c3b8f2238d577b1815db66892
SHA5128bb6ad95de15b391fe29dd892b0ccd8bedf9b8d675c2719ba9093258f8c99de37eb45fecd6c44f366cbbadd195e5a7bdf2c3537c4c3348e2ef868e08a58b861d
-
Filesize
471B
MD55cdd5b77bdee93b62b47bbdc6188c037
SHA1510816f1f173a0cb20d179b3adef79b976d4acae
SHA256412117a2bff34f6ee6e44934473ce3b1363adcb42d80ed32581e1e6cb51160fe
SHA51290d33526750d3543d27635f275023af0b4264fd9e13a1969b6412c56170aad53e28a7d88467f62375cdeba6eefdc121f3eae889f4b76e571dd66e6072b22725f
-
Filesize
404B
MD52fe9bf33c892babb6871bee2031461f2
SHA1091fd9ca370b998e77227ad0510d306d573ab2a7
SHA2566f02088eddfbe5213b3b76d4842f6ef180d83f972af1cb17e124e3c19cfb4f5c
SHA512f24fa4de42fa5f53e5a5b6469c3f5a0db68d7a18ff552f1bde45644e444012d1ab79025d09bf7c0c162be0f5a17d2a5b25ff019d566aa4bd28e100f42a2362df
-
Filesize
404B
MD50e20138df7dc0ed4bedea584a2186c7e
SHA1f9681738d0f456bbeb0fff6ef1b3fa32682e9286
SHA25690aa7c3afb2aebe4aab75668bfdfafca89663a9cfa9bcaa420e0404ed8456cc9
SHA5122ecf36932f22c3123cf737ae54400f910bf434051467f3157cd8557fabfb37de3c027512c725363128ae12f821f1e02251021315d8b5988b9f4b519acdcef06b
-
Filesize
78B
MD534258013e7466e3bbc0b4a2f556f437c
SHA1c878040a40abad6692369ed3501457e08b7d99ad
SHA256cae2a624f09cc188598291d01971fc1c9dc2dd994cd133ca2d8095abc3460b59
SHA512372e151d99ee4892098b241aabf3e2a7640ab9faf9920fe118d440984e779981592b66d1b8a87ce3ec6ca96bb032bb0a377412425bfa3f482e2044a54f5322b4
-
Filesize
3.0MB
MD51e5e57747f3223647eed93baedcd4e70
SHA141d021b36272d89bf3f5a51a5c42600ceab5a2d9
SHA256d3450195f893d7df66bfa051ef9bfea1859a7360749bbedd59567016d9abbe9f
SHA5122bb4349321c19f5edfb1a86c941df1294c75152191ed18ce64c170e3a66c9395d48aee44faf45d3cd2e311b3944738ae5278b4c26746c080f9cb5369a02e8ff8
-
Filesize
3.0MB
MD51e5e57747f3223647eed93baedcd4e70
SHA141d021b36272d89bf3f5a51a5c42600ceab5a2d9
SHA256d3450195f893d7df66bfa051ef9bfea1859a7360749bbedd59567016d9abbe9f
SHA5122bb4349321c19f5edfb1a86c941df1294c75152191ed18ce64c170e3a66c9395d48aee44faf45d3cd2e311b3944738ae5278b4c26746c080f9cb5369a02e8ff8
-
Filesize
5.2MB
-
Filesize
1.6MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
356KB
-
Filesize
1.6MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
356KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
5.2MB