Analysis
-
max time kernel
141s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
16/11/2023, 11:05
General
-
Target
017e0419fcb849cab6c7311d7b71f671570b71e1239f78fa3201eea819233876.exe
-
Size
15.8MB
-
MD5
8b93e40cdda9545f47c93bb0d3b44541
-
SHA1
9bf3a52a30a783062cedfa420c55be04f048eb18
-
SHA256
017e0419fcb849cab6c7311d7b71f671570b71e1239f78fa3201eea819233876
-
SHA512
14119f9ab7f5cff36613759db9441d6626461753859035f239c7ccd214a6a093c039a8253954558a7484325dca7b35a8f8e8d66293fe7a1dd1678fc2206a9a1a
-
SSDEEP
393216:sCdpg9wn5yUfejxlZFaRCiQyEPokxW4m4C:sCTgoHf0TaEhyEgH4mL
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\017e0419fcb849cab6c7311d7b71f671570b71e1239f78fa3201eea819233876.exe"C:\Users\Admin\AppData\Local\Temp\017e0419fcb849cab6c7311d7b71f671570b71e1239f78fa3201eea819233876.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÌìÁúСÃÛ[1116.1].exeC:\Users\Admin\AppData\Local\Temp\ÌìÁúСÃÛ[1116.1].exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ .bat""2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
173B
MD55576360029e9089d986e81fabb43c12e
SHA15449d49246963b4268cddd7fd3dc5547bb15b395
SHA25688324ff473801c6187ca4e8a80843feaa09b0b9a1e60212718f5ef99517ad2b8
SHA5128067f591f96550302c99e9ed06b57d8d2417827a2936fefd40c1c0ea682ed259317eae6760f63c7cd7581c2ca6d57bbbe66cc39eb1e3732be322bedf2a498a5b
-
Filesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
Filesize
1.6MB
MD55870ea0d6ba8dd6e2008466bdd00e0f4
SHA1d41bf60d0dedff90e3cfc1b41b7e1a73df39a7d5
SHA2565a7dac8c8b5d7cf1115246dfaf994e7f50e16a7eac1488642396f5e23fddfe0d
SHA5120c620d5e7383adcf979feccc3b1bad584a5cec8b3d74d0ace8bb786f1f04ba87fa70d59d041dc3833977d44a75f2070181d4054c7c0b9c4ce2d66249b4b3c837
-
Filesize
137KB
MD5f6b847a54cfb804a25b8842b45fd1d50
SHA1bb22fef07ce1577c8a7fa057d8cf05502c013bfc
SHA2565dd2f5a957946e0b6f63660ebd897851aad4795d4c847396c47ddbb647715583
SHA512dd08a55f538e2a33e6a0c496dc97ae9045594cbbf62f7894ae8ded63f4dc0b2e89c5935269adfd1c19607b1d2474bddc49f6acb955e6dc53a55560663ca2137a
-
Filesize
15.8MB
MD571ab5b24ddb3804ebf7ccc223700cc15
SHA1426ba1c0dde6f93f878fd5a6de93d2ecf530c2e8
SHA256726acf9c3611831d9b8ce7a31493ec5650094aa2853a0640de54cd623b515ee0
SHA5120b228e545162d5bca1c269d765a7f43e93d4dbd50aa66b9ca857e7212003a4adc01e3caffc65848cb273b3b0e4f954a0e4e7bc953ac0decd24359c73729bb3a4
-
Filesize
15.8MB
MD571ab5b24ddb3804ebf7ccc223700cc15
SHA1426ba1c0dde6f93f878fd5a6de93d2ecf530c2e8
SHA256726acf9c3611831d9b8ce7a31493ec5650094aa2853a0640de54cd623b515ee0
SHA5120b228e545162d5bca1c269d765a7f43e93d4dbd50aa66b9ca857e7212003a4adc01e3caffc65848cb273b3b0e4f954a0e4e7bc953ac0decd24359c73729bb3a4
-
Filesize
10B
MD5e68dcb2c7780120419a74d0fc5d051e0
SHA11996c187736ac49ea9ea894197be1d262b2d4e7f
SHA25655a25855c4788aca2b2778e56987ec2fe5df245a3ff20e67df28f893b452e602
SHA512492c7e23965ff80de3524907be5a5867a406b8685703771a8e5bd55c292cf31e78d66aa9198ab88ce182cf5c5029c72d8b73f6a48ac7cb6428da01fdb5064c5f
-
Filesize
74B
MD5ac93f5b2fd34bb1cec752d11d0aaadcd
SHA190f4babbc43991862bbb8ffafb20a8197416f83e
SHA2561dbbd245c3736dda2c7ddd25033c65f856ca2542e3b5839afd14ba7aec16a3f6
SHA5120c8cd5d7f5595709409dc7c2e878a98c813f7e4897959b5a9191f51655d0e2994485cfb6db383883024ec621ecd8f2ca1e24f5228653684f91ceb69dbc59502a
-
Filesize
74B
MD5ac93f5b2fd34bb1cec752d11d0aaadcd
SHA190f4babbc43991862bbb8ffafb20a8197416f83e
SHA2561dbbd245c3736dda2c7ddd25033c65f856ca2542e3b5839afd14ba7aec16a3f6
SHA5120c8cd5d7f5595709409dc7c2e878a98c813f7e4897959b5a9191f51655d0e2994485cfb6db383883024ec621ecd8f2ca1e24f5228653684f91ceb69dbc59502a
-
Filesize
3.0MB
MD554da9cb20347baec926b6678f8efb3ab
SHA118ca10861aa561c56666270cca7fd44c73c28d72
SHA256038675d5ee0b22a17a12646ba9cf3fcffd0a2acfb712c1953102671774a82390
SHA512e4608ef1875e2dd46c1352d5e750178ce439725a6b190d37a14decb7e960428841ea3ef5e17488226f9bcfc6d58793cb254f142ba4f54cd316c9cbee50cae77b
-
Filesize
3.0MB
MD554da9cb20347baec926b6678f8efb3ab
SHA118ca10861aa561c56666270cca7fd44c73c28d72
SHA256038675d5ee0b22a17a12646ba9cf3fcffd0a2acfb712c1953102671774a82390
SHA512e4608ef1875e2dd46c1352d5e750178ce439725a6b190d37a14decb7e960428841ea3ef5e17488226f9bcfc6d58793cb254f142ba4f54cd316c9cbee50cae77b
-
Filesize
3.0MB
MD554da9cb20347baec926b6678f8efb3ab
SHA118ca10861aa561c56666270cca7fd44c73c28d72
SHA256038675d5ee0b22a17a12646ba9cf3fcffd0a2acfb712c1953102671774a82390
SHA512e4608ef1875e2dd46c1352d5e750178ce439725a6b190d37a14decb7e960428841ea3ef5e17488226f9bcfc6d58793cb254f142ba4f54cd316c9cbee50cae77b
-
Filesize
3.0MB
MD554da9cb20347baec926b6678f8efb3ab
SHA118ca10861aa561c56666270cca7fd44c73c28d72
SHA256038675d5ee0b22a17a12646ba9cf3fcffd0a2acfb712c1953102671774a82390
SHA512e4608ef1875e2dd46c1352d5e750178ce439725a6b190d37a14decb7e960428841ea3ef5e17488226f9bcfc6d58793cb254f142ba4f54cd316c9cbee50cae77b
-
Filesize
3.0MB
MD554da9cb20347baec926b6678f8efb3ab
SHA118ca10861aa561c56666270cca7fd44c73c28d72
SHA256038675d5ee0b22a17a12646ba9cf3fcffd0a2acfb712c1953102671774a82390
SHA512e4608ef1875e2dd46c1352d5e750178ce439725a6b190d37a14decb7e960428841ea3ef5e17488226f9bcfc6d58793cb254f142ba4f54cd316c9cbee50cae77b
-
Filesize
3.0MB
MD554da9cb20347baec926b6678f8efb3ab
SHA118ca10861aa561c56666270cca7fd44c73c28d72
SHA256038675d5ee0b22a17a12646ba9cf3fcffd0a2acfb712c1953102671774a82390
SHA512e4608ef1875e2dd46c1352d5e750178ce439725a6b190d37a14decb7e960428841ea3ef5e17488226f9bcfc6d58793cb254f142ba4f54cd316c9cbee50cae77b
-
Filesize
6.3MB
-
Filesize
4KB
-
Filesize
6.3MB
-
Filesize
6.3MB
-
Filesize
4KB
-
Filesize
6.3MB