Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
-
submitted
20-11-2023 02:57
General
-
Target
10beb6f271ff10c87132ca40eb90f6d89cbe61aac4b0c6b2db6c1bcdbb7fb291.exe
-
Size
670KB
-
MD5
f11155ae786a74b4b6766f6849fa0b0b
-
SHA1
c6c3b33b2f46b1236ae8ff045151c1ddc30c822e
-
SHA256
10beb6f271ff10c87132ca40eb90f6d89cbe61aac4b0c6b2db6c1bcdbb7fb291
-
SHA512
733bef31a54e83d077f8f052c9b5a8b3d9ce894cd0dd528f01a6d3244c1f2696d45ce3171c01101057b854a3fccf00b0204e50a2a0c30e2316c7eebc646ce187
-
SSDEEP
12288:gYh9c1Xze30Y33Oc7jEWdsV7ds9HQlbBlhQLFN7:Jzc1KkY33Oc7jEWdcd8HyZWl
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 4 IoCs
-
Gh0st RAT payload 1 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 41 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\10beb6f271ff10c87132ca40eb90f6d89cbe61aac4b0c6b2db6c1bcdbb7fb291.exe"C:\Users\Admin\AppData\Local\Temp\10beb6f271ff10c87132ca40eb90f6d89cbe61aac4b0c6b2db6c1bcdbb7fb291.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\10beb6f271ff10c87132ca40eb90f6d89cbe61aac4b0c6b2db6c1bcdbb7fb291.txt2⤵
- Opens file in notepad (likely ransom note)
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649KB
MD5d504f3e79833f38f69ab0696a9ed8205
SHA188ca3e8ec7886048102125539b22b2e7d3ec3dc5
SHA256174c0c0d80346d35c31674baf20f06040341ebd6b5103c762e64fb7e1b4a244c
SHA512bc28d5566b5569f3a69ceb6b7c6db200aa22d6fcc41d4c03b18472143a44b58e8e4afa7d445c573d75f2cd3d375ae3cf568bc23f13e342cc80ee9f84c74638c1
-
Filesize
232B
MD57c6d73e998513522505ce81329095d10
SHA177fbde7b6289814315caef0247f4a4d0b24835bf
SHA2567807a7ea4d1cd978134c8d5da344b8a5b6562ebe4f972b88bcd7b7e29135d1f5
SHA512667d2f679ac45617231beb43f8017facc0032b7bd27ab597bded19be7706e848b1cf4fefc9aa5e2c56687efbb51891d194f5f6685ada5f633a0db64ab76f5fae
-
Filesize
2KB
MD57943effe67a4647e06def2348949020e
SHA1eabd561f0639a975de259633f63896d82c3f878d
SHA2563fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa
SHA512c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003
-
Filesize
940KB
-
Filesize
972KB
-
Filesize
1.6MB
-
Filesize
940KB
-
Filesize
12KB
-
Filesize
940KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
972KB
-
Filesize
1.6MB
-
Filesize
160KB
-
Filesize
972KB
-
Filesize
160KB
-
Filesize
92KB
-
Filesize
160KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
160KB
-
Filesize
160KB