Analysis
- max time kernel
117s - max time network
119s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
- submitted
07/01/2024, 19:35
General
- Target 20240106f05debf54fe5722d9430887cc806146fhacktoolsicedid.exe
- Size 4.7MB
- Sample240107-yay6eadfa3
- SHA256 d2fcd69ea514d5d72f88f86f3605d8559f1f94be3c064ee57e2f23bccb7b4961
Malware Config
Signatures
- Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
- Detect Blackmoon payload 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\20240106f05debf54fe5722d9430887cc806146fhacktoolsicedid.exe"C:\Users\Admin\AppData\Local\Temp\20240106f05debf54fe5722d9430887cc806146fhacktoolsicedid.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TPHelper.exeC:\Users\Admin\AppData\Local\Temp\\TPHelper.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
RCX4E2.tmp
TPHelperBase.dll
TPHelper.exe
memory/2224-875-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-867-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-19-0x0000000010000000-0x0000000010295000-memory.dmp
memory/2224-18-0x0000000000400000-0x0000000000675000-memory.dmp
memory/2224-837-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-849-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-861-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-869-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-879-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-865-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-891-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-889-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-885-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-883-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-881-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-877-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-2566-0x0000000010000000-0x0000000010295000-memory.dmp
memory/2224-873-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-20-0x00000000766B0000-0x00000000766F7000-memory.dmp
memory/2224-871-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-887-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-863-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-859-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-857-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-855-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-853-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-851-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-847-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-845-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-843-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-841-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-839-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-835-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-833-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-831-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-830-0x00000000025A0000-0x00000000026B1000-memory.dmp
memory/2224-2567-0x0000000000400000-0x0000000000675000-memory.dmp
memory/2380-16-0x00000000024F0000-0x0000000002765000-memory.dmp