Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/11/2023, 10:02

General

  • Target

    c327bf1c696f347a588b06dfad6bf93bf2b1a5a4bd71bb0ee8a93dcf61151b24.exe

  • Size

    10.6MB

  • MD5

    fc67886445ee161ea074e983ed87711a

  • SHA1

    16355b16649f046276de1ff4b1f09849263fbe71

  • SHA256

    c327bf1c696f347a588b06dfad6bf93bf2b1a5a4bd71bb0ee8a93dcf61151b24

  • SHA512

    4660dd31ec7097758f8b78fe13d581892ea8439dd7cf926097d7dba0b6952af54c503c95c1195764972fa14e49865e35b6b1c5c0b1a4611cf0a7e560e1920782

  • SSDEEP

    196608:OBOtbQ6JVjP93izWhcSIIMSfpV4b653gsAaGEoXM8:OBOtbQ6zFyyMSxVeegsGEIM8

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 12 IoCs
  • Executes dropped EXE 2 IoCs
  • VMProtect packed file 12 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c327bf1c696f347a588b06dfad6bf93bf2b1a5a4bd71bb0ee8a93dcf61151b24.exe
    "C:\Users\Admin\AppData\Local\Temp\c327bf1c696f347a588b06dfad6bf93bf2b1a5a4bd71bb0ee8a93dcf61151b24.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4520
    • C:\Users\Admin\AppData\Local\Temp\Adunyychex.exe
      C:\Users\Admin\AppData\Local\Temp\Adunyychex.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4972
    • C:\Users\Admin\AppData\Local\Temp\Adunyychex.exe
      "C:\Users\Admin\AppData\Local\Temp\Adunyychex.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\85EB.tmp

    Filesize

    137KB

    MD5

    f6b847a54cfb804a25b8842b45fd1d50

    SHA1

    bb22fef07ce1577c8a7fa057d8cf05502c013bfc

    SHA256

    5dd2f5a957946e0b6f63660ebd897851aad4795d4c847396c47ddbb647715583

    SHA512

    dd08a55f538e2a33e6a0c496dc97ae9045594cbbf62f7894ae8ded63f4dc0b2e89c5935269adfd1c19607b1d2474bddc49f6acb955e6dc53a55560663ca2137a

  • C:\Users\Admin\AppData\Local\Temp\Adunyychex.exe

    Filesize

    10.6MB

    MD5

    ca39fb64b5174e76fd83f5fe455a28d4

    SHA1

    b41e330dcab94836e52d4e1694b4cac540145e07

    SHA256

    9ad0e682853e3aa3e6fe037d42422b37ca144f229910df6623fd87b1c8d4ba37

    SHA512

    a534659f1574ec2be4327a45805ec33e13e23d2786207ceb28b8f70b982cfc8263936710ea1a4f11296c51bbb70961c5b653e006db490b95c6008a93cf1c0159

  • C:\Users\Admin\AppData\Local\Temp\Adunyychex.exe

    Filesize

    10.6MB

    MD5

    ca39fb64b5174e76fd83f5fe455a28d4

    SHA1

    b41e330dcab94836e52d4e1694b4cac540145e07

    SHA256

    9ad0e682853e3aa3e6fe037d42422b37ca144f229910df6623fd87b1c8d4ba37

    SHA512

    a534659f1574ec2be4327a45805ec33e13e23d2786207ceb28b8f70b982cfc8263936710ea1a4f11296c51bbb70961c5b653e006db490b95c6008a93cf1c0159

  • C:\Users\Admin\AppData\Local\Temp\Adunyychex.exe

    Filesize

    10.6MB

    MD5

    ca39fb64b5174e76fd83f5fe455a28d4

    SHA1

    b41e330dcab94836e52d4e1694b4cac540145e07

    SHA256

    9ad0e682853e3aa3e6fe037d42422b37ca144f229910df6623fd87b1c8d4ba37

    SHA512

    a534659f1574ec2be4327a45805ec33e13e23d2786207ceb28b8f70b982cfc8263936710ea1a4f11296c51bbb70961c5b653e006db490b95c6008a93cf1c0159

  • C:\Users\Admin\AppData\Local\Temp\e5781e2.tmp

    Filesize

    1.6MB

    MD5

    5870ea0d6ba8dd6e2008466bdd00e0f4

    SHA1

    d41bf60d0dedff90e3cfc1b41b7e1a73df39a7d5

    SHA256

    5a7dac8c8b5d7cf1115246dfaf994e7f50e16a7eac1488642396f5e23fddfe0d

    SHA512

    0c620d5e7383adcf979feccc3b1bad584a5cec8b3d74d0ace8bb786f1f04ba87fa70d59d041dc3833977d44a75f2070181d4054c7c0b9c4ce2d66249b4b3c837

  • C:\Users\Admin\AppData\Local\Temp\e5781e2.tmp

    Filesize

    1.6MB

    MD5

    4f3387277ccbd6d1f21ac5c07fe4ca68

    SHA1

    e16506f662dc92023bf82def1d621497c8ab5890

    SHA256

    767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

    SHA512

    9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

  • memory/1776-53-0x0000000010000000-0x0000000010041000-memory.dmp

    Filesize

    260KB

  • memory/1776-51-0x0000000000400000-0x0000000000EB6000-memory.dmp

    Filesize

    10.7MB

  • memory/1776-52-0x0000000000400000-0x0000000000EB6000-memory.dmp

    Filesize

    10.7MB

  • memory/1776-72-0x0000000000400000-0x0000000000EB6000-memory.dmp

    Filesize

    10.7MB

  • memory/1776-50-0x0000000000F10000-0x0000000000F11000-memory.dmp

    Filesize

    4KB

  • memory/4520-2-0x0000000000400000-0x0000000000EB6000-memory.dmp

    Filesize

    10.7MB

  • memory/4520-1-0x0000000000400000-0x0000000000EB6000-memory.dmp

    Filesize

    10.7MB

  • memory/4520-0-0x0000000002C10000-0x0000000002C11000-memory.dmp

    Filesize

    4KB

  • memory/4520-73-0x0000000000400000-0x0000000000EB6000-memory.dmp

    Filesize

    10.7MB

  • memory/4520-3-0x0000000010000000-0x0000000010041000-memory.dmp

    Filesize

    260KB

  • memory/4972-27-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

    Filesize

    4KB

  • memory/4972-29-0x0000000000400000-0x0000000000EB6000-memory.dmp

    Filesize

    10.7MB

  • memory/4972-28-0x0000000000400000-0x0000000000EB6000-memory.dmp

    Filesize

    10.7MB

  • memory/4972-74-0x0000000000400000-0x0000000000EB6000-memory.dmp

    Filesize

    10.7MB