Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
25-11-2023 19:32
General
-
Target
f75097a82943df61ba0c412078536d6a3463682304ae7ebf03775878a4f1a1a9.exe
-
Size
828KB
-
MD5
8de5b1a93f56063625b11f6faa22e8a6
-
SHA1
9fd9abdb39d35f66daba30710f147a70b79bb78f
-
SHA256
f75097a82943df61ba0c412078536d6a3463682304ae7ebf03775878a4f1a1a9
-
SHA512
b603e83ebd412d27834e1fa4762f609c0e2b5e9513ae92b20b3e4a5e775505ea27bff205ae94d70c10ff858b2e9f3c8f5aca55fb9531ecfca550b74c9215b8df
-
SSDEEP
12288:l3ouotYCuoyHVkWQWpy8VgSf1/Y4gcl/t03Rbd2:l3ou/6y1kwySgM/Y4gcl/K3v2
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 4 IoCs
-
Gh0st RAT payload 1 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 41 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f75097a82943df61ba0c412078536d6a3463682304ae7ebf03775878a4f1a1a9.exe"C:\Users\Admin\AppData\Local\Temp\f75097a82943df61ba0c412078536d6a3463682304ae7ebf03775878a4f1a1a9.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\f75097a82943df61ba0c412078536d6a3463682304ae7ebf03775878a4f1a1a9.txt2⤵
- Opens file in notepad (likely ransom note)
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649KB
MD5d504f3e79833f38f69ab0696a9ed8205
SHA188ca3e8ec7886048102125539b22b2e7d3ec3dc5
SHA256174c0c0d80346d35c31674baf20f06040341ebd6b5103c762e64fb7e1b4a244c
SHA512bc28d5566b5569f3a69ceb6b7c6db200aa22d6fcc41d4c03b18472143a44b58e8e4afa7d445c573d75f2cd3d375ae3cf568bc23f13e342cc80ee9f84c74638c1
-
Filesize
278B
MD57a0f22061536761c18cb82be2fa081e1
SHA12c297dc706eb2ef1b906d8b52aff66b72cf59f43
SHA256ebf28f400ca48c81d349af96372098dc245f57a57cb0cd4defae24035922b5e4
SHA512656f2804f436a850421420068c13d0410aa25cd53be7ed7bcfb06b6c852dc047b88f73e94cd051868105e8f2028acb02cec0166bbee3fab3548ee89aa269e0d1
-
Filesize
2KB
MD57943effe67a4647e06def2348949020e
SHA1eabd561f0639a975de259633f63896d82c3f878d
SHA2563fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa
SHA512c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003
-
Filesize
972KB
-
Filesize
160KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
972KB
-
Filesize
940KB
-
Filesize
160KB
-
Filesize
12KB
-
Filesize
972KB
-
Filesize
92KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
940KB
-
Filesize
940KB