Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29/12/2023, 20:58
General
-
Target
03d39237e46983d571a602be445752f6.exe
-
Size
425KB
-
MD5
03d39237e46983d571a602be445752f6
-
SHA1
151f7ce5632c25d7c8be38fdc9ca83f99c7876ce
-
SHA256
57de7cee41f4ae1a322b1cbe583be6e4de79fa6c76ca8aef37b663ac80158ed2
-
SHA512
322c17bc070fc0e395fac7286ffb3cf1cb077651d17aada8fb347b28cccf7508d28bfb1863b64d6a5c0e843689ae7d1f1466d1c6e697fc6f8890b711072bb511
-
SSDEEP
6144:evk3Q5ibjnNuuXckaL7pbRBkce97awz7L7orT2O:evMQ5ibjnwka3pbRC19Gwz7orT2O
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 6 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\03d39237e46983d571a602be445752f6.exe"C:\Users\Admin\AppData\Local\Temp\03d39237e46983d571a602be445752f6.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Systemlzhal.exe"C:\Users\Admin\AppData\Local\Temp\Systemlzhal.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
171KB
MD5c527387b819fe833bd52edd659cef3a2
SHA150a7ac32bc87a04aa5eb18912862bf435c667fe8
SHA256af2e2db343bccd65cf94c1e5db75fa6f5cb8c9c3e7933413164bf68b90ab7b2b
SHA5122cf52b99b904a376cfb19b876d5ee9a92b2e69de8b8c85c4d69b00c826d2b74151c088094e7072bfde80c9b7b7b94319b105390049afc63a186312a295a2fe3d
-
Filesize
425KB
MD5625b94327c3778295f029a99e363e4dc
SHA165d14fa8a868e074e076f6502cb9076d3bda1d9b
SHA256ae3ff9d1ed118d2c337cc959caa6a351cdc53e591c3381cbab8c61fb33b16aff
SHA512caf66e725505348ec22a2a0836ce8d199b5b726febc7dd3662207ba1265c3c4773b18eefbcfebfb7fcea1d48a4df19840637241fdafcf1e05c8cf61b09d07f10
-
Filesize
146KB
MD5b61467816e2dea9052275bd0e53d62a1
SHA1f70919c9a48f0a36ff5f1eeaafa7d781321b48e3
SHA2562ebecb98a81b877d06ceebf1467e9b7bf1e4821a5ff84cb5ecfc062f13429462
SHA5122d8b2475afe0a53365db3b229415ea191c44601b1c9fac495c6bd80038b2bcbd59b279be07074d2cff08f53a144faf6be269edcc1bd48ea24c9dd194304470b0
-
Filesize
70B
MD52893ad06f5f205edbb5f61c4c3b47330
SHA11c2b9ffb1401acf428fe3065a48273a91413d1ad
SHA256300a4bbfcd56a0fd9f2b6c5b4ade0cb1e9366fdd5f866e2c49327c65933dbfaa
SHA512f65c94d7a79fa9490ef612dfccc75bfe674a9466cb1c11f47b9dcd66483fc749a8a4b34534f883f1ba048dd67d9c7b943f2607401b6ce8298f5534354cd85feb
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB