Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
-
submitted
23/11/2023, 20:58
General
-
Target
8e69f7b40845c53894602eceb2cf16b09aa52e905149e6f8f10481200c2d62a8.exe
-
Size
3.0MB
-
MD5
7f8b2250ae6320c2d72a2c422ebc9f98
-
SHA1
76b6e4d81d9eedfdea56fe99a8ded4c61dd37aa0
-
SHA256
8e69f7b40845c53894602eceb2cf16b09aa52e905149e6f8f10481200c2d62a8
-
SHA512
21526bea1adf151dc2c777e967ff5e6665a4f62f7efc171baf1b85be880228a38198c15b3e6e58f464bbd1224f84b18738e59d2b1794ca9a8bf899f258a31dde
-
SSDEEP
49152:PJxd6rnwFDP4vBkHep9Shf1HlV/mYLHCbE/xjA/B8MN0Jra3NuhzEYLXCGLcv7H:PJmrCDwim98RldfibEowaNooc3Lcv7H
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 21 IoCs
-
ASPack v2.12-2.42 2 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Deletes itself 1 IoCs
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e69f7b40845c53894602eceb2cf16b09aa52e905149e6f8f10481200c2d62a8.exe"C:\Users\Admin\AppData\Local\Temp\8e69f7b40845c53894602eceb2cf16b09aa52e905149e6f8f10481200c2d62a8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\genwangame\8e69f7b40845c53894602eceb2cf16b09aa52e905149e6f8f10481200c2d62a8[ʵ]\8e69f7b40845c53894602eceb2cf16b09aa52e905149e6f8f10481200c2d62a8[ʵ].exeC:\Users\Admin\AppData\Roaming\genwangame\8e69f7b40845c53894602eceb2cf16b09aa52e905149e6f8f10481200c2d62a8[ʵ]\8e69f7b40845c53894602eceb2cf16b09aa52e905149e6f8f10481200c2d62a8[ʵ].exe -t 3068 C:\Users\Admin\AppData\Local\Temp\8e69f7b40845c53894602eceb2cf16b09aa52e905149e6f8f10481200c2d62a8.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\genwangame\cqzj_sevice\Õ½¼ÇÊÚȨ¹«Ê¾Óë·À³ÁÃÔÈÏÖ¤.exeC:\Users\Admin\AppData\Roaming\genwangame\cqzj_sevice\Õ½¼ÇÊÚȨ¹«Ê¾Óë·À³ÁÃÔÈÏÖ¤.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\genwangame\8e69f7b40845c53894602eceb2cf16b09aa52e905149e6f8f10481200c2d62a8[ʵ]\Èý¹úÕ½¼Í¡¤[аæ¢ò].exeC:\Users\Admin\AppData\Roaming\genwangame\8e69f7b40845c53894602eceb2cf16b09aa52e905149e6f8f10481200c2d62a8[ʵ]\Èý¹úÕ½¼Í¡¤[аæ¢ò].exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
F:\Èý¹úÕ½¼Í΢¶Ë[2.0]\Èý¹úÕ½¼Í¡¤[аæ¢ò].exeF:\Èý¹úÕ½¼Í΢¶Ë[2.0]\Èý¹úÕ½¼Í¡¤[аæ¢ò].exe4⤵
- Executes dropped EXE
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
471B
MD5d94c0d6daf5b21befc1ef4e917034d16
SHA16a8b0fa876f8974add5535289dc4081606a1fd4a
SHA256df441eb5ee65ee52072a79f9f25b2b11ecf995d050d14b5451706119f9d5038d
SHA5121d3e5d8876d7e8c54caadd153df00aea9570017c017f93a1aa5561aea6b423a3d2e42dffae32c993a0e40c18f4013a640299005d0cf3a6cb3fc2bfcace07843d
-
Filesize
471B
MD505f9970c24641a8b6caea56e3bd257b2
SHA152775a589d8e0ae9dc2078adf4e06dcdc87af442
SHA256eea20a2a77f472a153b9f29b084dbc6fb44b200f9dc9663c550cf50467a642b9
SHA512c074cb12ae5700f04c574ff9ee79525c352446ca7fb6651a00de31f3b7784a855dc7fcc8efe182f9a7d8adcf3adcac038979ff9b71570f0f88f3e80806684a6e
-
Filesize
404B
MD5c574bc8ed4e2d6e3b9db28846dfec548
SHA1759902a1d6c222ccc39d0b3094c99ac72047b137
SHA256c1f1b39e5ff8fe2c868a6bbce19f8d876b796e7400485d04e10be68e06bef5ad
SHA5123ad62e5965a68091db2177f440ce379c80b5324059bfd04fc93b5c69cd1e78879bb46003876b7442a36199227d21f55720c500de4109ea07635d988640e2e9ca
-
Filesize
404B
MD589c1a6bb1f8ad6fa14e28ef6c95e0d8b
SHA1b63538455cccfe05089f14fd7feee13700f639f9
SHA25630b12e04a996a7b9177ef378956472afe802b553d8afb68f914705de4caf9857
SHA5126efed5a5646a8520fb5d0f344351ea35fb945ae8e1fd464ae4e6bd320fef5a5c8870e95e02e3b92a57cf678706cca98865eda89318a8cfedd458c5725352b856
-
Filesize
102B
MD52306cde28cdc3e4d289ee9c1e31b332c
SHA1d55cd9caf698f141cf6df0339086de405873707d
SHA256c317a1a1b168ac2943acbd1ea4fd4429a4913b03cbb4d2e4b330f8a890f4930d
SHA512500e35c6e49757947d02fb210914faea11b4cbb50d07e8e437e503ae38645b37d614670c424ae6b80c089feb1fb9c0401ba87787e12fa481f4f758bcc6037abf
-
Filesize
3.0MB
MD57f8b2250ae6320c2d72a2c422ebc9f98
SHA176b6e4d81d9eedfdea56fe99a8ded4c61dd37aa0
SHA2568e69f7b40845c53894602eceb2cf16b09aa52e905149e6f8f10481200c2d62a8
SHA51221526bea1adf151dc2c777e967ff5e6665a4f62f7efc171baf1b85be880228a38198c15b3e6e58f464bbd1224f84b18738e59d2b1794ca9a8bf899f258a31dde
-
Filesize
3.0MB
MD57f8b2250ae6320c2d72a2c422ebc9f98
SHA176b6e4d81d9eedfdea56fe99a8ded4c61dd37aa0
SHA2568e69f7b40845c53894602eceb2cf16b09aa52e905149e6f8f10481200c2d62a8
SHA51221526bea1adf151dc2c777e967ff5e6665a4f62f7efc171baf1b85be880228a38198c15b3e6e58f464bbd1224f84b18738e59d2b1794ca9a8bf899f258a31dde
-
Filesize
50.9MB
MD5936b64faee3073feb51ad2fb1ad80ab2
SHA152235c05c682607c556db1bf7fc1029c5b1a51dd
SHA256cabb94eb2de6d136e3be80a614c5306e1ac5670aff62580ecea0b29f2d811b4f
SHA512f58086af51233528ac5f1208cf0942fb4d1aedf64dfa7eea757301225bbf78e5e5252b598893e865384ce676a784f978f2206a163573a321897daa0f7cec230e
-
Filesize
50.9MB
MD5936b64faee3073feb51ad2fb1ad80ab2
SHA152235c05c682607c556db1bf7fc1029c5b1a51dd
SHA256cabb94eb2de6d136e3be80a614c5306e1ac5670aff62580ecea0b29f2d811b4f
SHA512f58086af51233528ac5f1208cf0942fb4d1aedf64dfa7eea757301225bbf78e5e5252b598893e865384ce676a784f978f2206a163573a321897daa0f7cec230e
-
Filesize
1.6MB
MD5031ad1ecd93701d39265771942ec716c
SHA1cb3ef507bf0e848894fbb96a29bfc94a0c302152
SHA2569a7fde2ea7883701bf858e0daef74d787a31c3cbd9f1171cec0a3a382ee9e6ba
SHA512374dab32b6304834c7acd8b5e6701ece016bf57d3abdd416ef2b63f7cbda24c9e59f9dfc27b6823ac6256bbab38aace74334dec7d57f1ef6cb9b80c239003bae
-
Filesize
1.6MB
MD5031ad1ecd93701d39265771942ec716c
SHA1cb3ef507bf0e848894fbb96a29bfc94a0c302152
SHA2569a7fde2ea7883701bf858e0daef74d787a31c3cbd9f1171cec0a3a382ee9e6ba
SHA512374dab32b6304834c7acd8b5e6701ece016bf57d3abdd416ef2b63f7cbda24c9e59f9dfc27b6823ac6256bbab38aace74334dec7d57f1ef6cb9b80c239003bae
-
Filesize
100B
MD57abcb5a35f2ea989c1d5f7e9e225df28
SHA1bdf9d2f36afb28beab54b8615ef0f47661c98a9d
SHA2561fc49e5a28b295f3ca5fe96710e0c0bfd8a484dcfd7fb0db6f7f5331aae3e475
SHA51284bcba442f767f07fa3a670f5bd18d6991ce97bc505d11959e630d4db224982e72a4c1bd4073b45c9fbbc0c68d630542eda3b28de3669fc519048b0ae4eaf0cf
-
Filesize
4.1MB
MD55ec0331e4fa08ab2ee9897812861a2dc
SHA1814da663266dde484fcdfba5154a414cc8672bc0
SHA256bdbf6c411df4c0db58d42b747ad78baf03b5e122a68e067d311456ff83f38f9d
SHA512192a6bcafc329527d59351a0b37b5c67c860932a676942abf382915542637c301d0195bcf099151d9be5305a371cb36b4219951c699ff1b1f24779170988ce9f
-
Filesize
4.1MB
MD55ec0331e4fa08ab2ee9897812861a2dc
SHA1814da663266dde484fcdfba5154a414cc8672bc0
SHA256bdbf6c411df4c0db58d42b747ad78baf03b5e122a68e067d311456ff83f38f9d
SHA512192a6bcafc329527d59351a0b37b5c67c860932a676942abf382915542637c301d0195bcf099151d9be5305a371cb36b4219951c699ff1b1f24779170988ce9f
-
Filesize
12.7MB
MD5ad42aaeca262a6a10b1b64a15bd47e37
SHA1b8fcfab93793cf867afbecec58c7e44776d70974
SHA256177a209b0a7b3c50b9f5db1afc2ec5ecec03ca132466c2b1f699973b550f85f6
SHA512c2e7c11e1f3c2a1f60a760617ecc40e7578204ed309babc7b6ce4ee8833dbdceefaef9d1dc88259ff370108c06a63b4ee778e73e96f638bd0665d4266bc6116a
-
Filesize
1.6MB
MD591e1e03186b21a18f86ba26080d474e0
SHA1c70b3cabfe56bcbf237f5541e8604a138633f2ca
SHA25676af3f6c7a3e56eeda09a86adbeb99bab9cd6054e3de0f0a361fe5b3f822a97f
SHA51264eaba24df72380170b32280d6519991922db2c2cfd10ee355c55aeace70a1ef965ad705e9e1e2e7eaad96fb5a6db4ff49fafd95b332f5582159835e03345e75
-
Filesize
1.1MB
MD5b9e3b5a4a079901b72d4e2ade0d0d41a
SHA1362bfe8892338668dcc34d1ac7e050ee176cd5be
SHA2564b50486dea4b5d428d4f39125dd454cfd0e2a1c5d908dc87686d61d9d3141dc9
SHA512876e8b045aeebd9fe4fcd1e8c664abeee42229ae13a5936706a3d7cd40cdbfc3e358ba0bc135d1daa868a991f1a581447566a527009af97296adbb28f95b7c7d
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
356KB
-
Filesize
1.6MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
1.6MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
356KB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
1.6MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.8MB
-
Filesize
6.8MB
-
Filesize
844KB
-
Filesize
6.8MB
-
Filesize
4KB
-
Filesize
5.2MB
-
Filesize
1.6MB
-
Filesize
5.2MB
-
Filesize
356KB
-
Filesize
1.6MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
10.9MB
-
Filesize
356KB
-
Filesize
12KB
-
Filesize
10.9MB
-
Filesize
6.8MB
-
Filesize
6.8MB