Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    07/01/2024, 19:35

General

  • Target

    20240106f05debf54fe5722d9430887cc806146fhacktoolsicedid.exe

  • Size

    4.7MB

  • MD5

    f05debf54fe5722d9430887cc806146f

  • SHA1

    587b8c06feb2ef924ddc2b3d098a55c786ef26c5

  • SHA256

    d2fcd69ea514d5d72f88f86f3605d8559f1f94be3c064ee57e2f23bccb7b4961

  • SHA512

    29c5ae6eade8a098492bf6dde6d4fa6d05c51dd179031a321fc254c053ac8055c6d0fdd56d5f3bb60a1985b777d48e0b89029bcfe403c82c3c90b6543f76f9f6

  • SSDEEP

    49152:HMwN00ppnsoBTKtKXzdFo8hnK6xPLeBsVu9Cdca7t47FUHhKbieBHuzZ/S9fJpil:swN9V/TKWfxlcsAAd9OOk2WCZ/kjou6

Score
10/10

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\20240106f05debf54fe5722d9430887cc806146fhacktoolsicedid.exe
    "C:\Users\Admin\AppData\Local\Temp\20240106f05debf54fe5722d9430887cc806146fhacktoolsicedid.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Users\Admin\AppData\Local\Temp\TPHelper.exe
      C:\Users\Admin\AppData\Local\Temp\\TPHelper.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2224

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\RCX4E2.tmp

          Filesize

          385KB

          MD5

          35ad2688f70633fe65f435f7aac8391f

          SHA1

          d0fd9ea0fa3836688064f50d5c96f281e2830b42

          SHA256

          1b0482ba2c3c72a71508a009c881c1f45193a7b3987d3f76b8cf43263cc78cec

          SHA512

          4d157e8b0429a1f3b167bd7d6302435bf436b253e6cc1043e4e0e34bd2094a658f13846b18f99bc968e74fdd0a1f52de1e073afffad3049d5f458e0f7bc3b4b4

        • C:\Users\Admin\AppData\Local\Temp\TPHelperBase.dll

          Filesize

          92KB

          MD5

          def3b0579cea1e1bcd6c30a818f0a2e5

          SHA1

          e57da62fd32d02725eebb27bae3f830ce4148f1d

          SHA256

          d81a87646314713e9242650e72e442e8a306864ba6f0a615e215828b0cf23756

          SHA512

          4b17880768a1c72856940350416381496d60b2feb0f6274d141c4ce2d7a7da64a534debdeb5651e76440a742c4767df3ff0315841a466330b3010f47bc5175f6

        • \Users\Admin\AppData\Local\Temp\TPHelper.exe

          Filesize

          382KB

          MD5

          a413d742ab8168ddf9ca8a12df5757f3

          SHA1

          96e4fae4ed92d83126aeeb3d207491c64bea903a

          SHA256

          25f508f415a9890f2da568cd830499334c340fc88a840cd1b77862182f63d753

          SHA512

          88eca809348c15924b4627d675e5423073e6760d26d1fd4946c5a4001bea2d4406e3836d787790ec85d0ad3a5acbf25bbe932043a93040564feaf7d29d95eabd

        • memory/2224-875-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-867-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-19-0x0000000010000000-0x0000000010295000-memory.dmp

          Filesize

          2.6MB

        • memory/2224-18-0x0000000000400000-0x0000000000675000-memory.dmp

          Filesize

          2.5MB

        • memory/2224-837-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-849-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-861-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-869-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-879-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-865-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-891-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-889-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-885-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-883-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-881-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-877-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-2566-0x0000000010000000-0x0000000010295000-memory.dmp

          Filesize

          2.6MB

        • memory/2224-873-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-20-0x00000000766B0000-0x00000000766F7000-memory.dmp

          Filesize

          284KB

        • memory/2224-871-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-887-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-863-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-859-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-857-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-855-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-853-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-851-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-847-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-845-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-843-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-841-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-839-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-835-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-833-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-831-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-830-0x00000000025A0000-0x00000000026B1000-memory.dmp

          Filesize

          1.1MB

        • memory/2224-2567-0x0000000000400000-0x0000000000675000-memory.dmp

          Filesize

          2.5MB

        • memory/2380-16-0x00000000024F0000-0x0000000002765000-memory.dmp

          Filesize

          2.5MB