Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
21/11/2023, 10:02
General
-
Target
f41127478f06c7ae7678e61ca05988789cbb78beb04d105cb5ddfc441d9aa630.exe
-
Size
343KB
-
MD5
2ec3a66a0590ce7cfc2ef71e71635860
-
SHA1
062db91c2fcd8d0d7e44bf25e168bd0c0b0ff949
-
SHA256
f41127478f06c7ae7678e61ca05988789cbb78beb04d105cb5ddfc441d9aa630
-
SHA512
b0db83935fc32d4aac973225ee15f059c0c23d1cc2be8f32d6cb5689c216c8d0af64f7b62f7029dc3ec8dd16ff7639e826d5ff95277aa4302b03c1f5f61b8694
-
SSDEEP
6144:mCU/d3jO7xaRzfap6a3hTW1QZ6/uPKADFBWe0EbDP3dGbQXoh0W4CChNb:m95jOYRzyp6WhTWmPVDvb3D4hR4CChp
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 4 IoCs
-
Gh0st RAT payload 1 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 41 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f41127478f06c7ae7678e61ca05988789cbb78beb04d105cb5ddfc441d9aa630.exe"C:\Users\Admin\AppData\Local\Temp\f41127478f06c7ae7678e61ca05988789cbb78beb04d105cb5ddfc441d9aa630.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\f41127478f06c7ae7678e61ca05988789cbb78beb04d105cb5ddfc441d9aa630.txt2⤵
- Opens file in notepad (likely ransom note)
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649KB
MD5d504f3e79833f38f69ab0696a9ed8205
SHA188ca3e8ec7886048102125539b22b2e7d3ec3dc5
SHA256174c0c0d80346d35c31674baf20f06040341ebd6b5103c762e64fb7e1b4a244c
SHA512bc28d5566b5569f3a69ceb6b7c6db200aa22d6fcc41d4c03b18472143a44b58e8e4afa7d445c573d75f2cd3d375ae3cf568bc23f13e342cc80ee9f84c74638c1
-
Filesize
262B
MD5769a6075afe5e21962cd46e2e00a156b
SHA10f21e7f4e5eb9ba13e41515c5c7f80a849ed3859
SHA25653f5b5a6adbada64340fd5fbfdda1d8781047a72b5abcda3744d06da470303e0
SHA512239e796cd08cc2933716bf33e54808329d71f89b553eaf30ebd4d4f8493591b6d60a62f8dc0f5a6542bc96760650522b6267759f9fd77bbb4f76b7106e9986bf
-
Filesize
2KB
MD57943effe67a4647e06def2348949020e
SHA1eabd561f0639a975de259633f63896d82c3f878d
SHA2563fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa
SHA512c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003
-
Filesize
940KB
-
Filesize
972KB
-
Filesize
932KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
12KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
972KB
-
Filesize
932KB
-
Filesize
160KB
-
Filesize
972KB
-
Filesize
160KB
-
Filesize
92KB
-
Filesize
160KB
-
Filesize
940KB
-
Filesize
160KB
-
Filesize
940KB