Analysis
-
max time kernel
151s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
10/01/2024, 09:41
General
-
Target
a36d90a69729cfcdde459e27efc693d49c29773f8976d66844aa2c6e61cfe6d5.exe
-
Size
9.9MB
-
MD5
472c8a6f504b9cd3f40090cfa956ed6c
-
SHA1
d5fe1d6c84b007996bc7bad1a4fb2b853bf89e5f
-
SHA256
a36d90a69729cfcdde459e27efc693d49c29773f8976d66844aa2c6e61cfe6d5
-
SHA512
f41857219f69ff6200bb5fb4af1014a53992d7c5ca0ccae1334f8d87a94a7d94622f73a7c309f56c74e4dcde7f896ebcb27352e68bc75e72627049edfafd1350
-
SSDEEP
196608:zYnGKWUGNEoiN/A4sZvnGfq9nY3ESrKxzWMKkrUr3pM7I41vSnS2A7:UnjpGNvxnrnTygar3xgvSnSZ7
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 11 IoCs
-
ASPack v2.12-2.42 2 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a36d90a69729cfcdde459e27efc693d49c29773f8976d66844aa2c6e61cfe6d5.exe"C:\Users\Admin\AppData\Local\Temp\a36d90a69729cfcdde459e27efc693d49c29773f8976d66844aa2c6e61cfe6d5.exe"1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Èý½çÖ®áÛ΢¶Ë\21162a36d90a69729cfcdde459e27efc693d49c29773f8976d66844aa2c6e61cfe6d5.exeC:\Èý½çÖ®áÛ΢¶Ë\21162a36d90a69729cfcdde459e27efc693d49c29773f8976d66844aa2c6e61cfe6d5.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD5211fc700d32d80bd507655db7ab7050c
SHA105993e2b3638388fdda27f7c68419bb2bf38fd2e
SHA25602b81af1f327c4c83d420ed9c856960878a1bd538a29a6fcb8ee7d31b943b6da
SHA512cc6094ab9199d554c2e9a1898a10332306d827db8681106727891028c3ddf92fd8e16c69fdea32437b719eb4aaf66102cc62401fa848ae968b85a136f4fb22e4
-
Filesize
10KB
MD5274e81a994c9ec817375b9763d0a57e4
SHA1b9e96e4534ad3613b7f4ee1640a8f7281c543490
SHA2562d8874282b846794f40f576690dc2d686310863b9838ed1ae000448f314a743b
SHA512a4ef58b2456298e79b444d08e5d2355d04d02e8ccd4a6214b3a9869992ee67aa673652b53fbad119b573f6640c70effffba519ceb3256b18798c47d1c0d64817
-
Filesize
1.4MB
MD5d772a4343904b5b740d65c879b80a151
SHA1873acddc0dc83fd276442ba1169f9441423d211f
SHA25652eb1de4bf01215af071de128d615923065ab652377e31b24bc493e4de6cdaca
SHA51247b0b50935070115c558ba72c26f8a247da1ac1639782cba45de902ae3f3b29df54938ba54490f8fa3250129f881a882b2f06fb70f377fbb35380477d24271b1
-
Filesize
979KB
MD55fff92ca883ffa06d8cc285420a5f084
SHA1b7d6509a31f7768b99b6fca863cfd481d7823c60
SHA256ba7a00de60acb92672b25fa6f321625b8fa841fa60bc6c1d5de39b40c9e02b47
SHA512011c77fb241cee62da249263a6adcb8da8167ac11a181edd308547d0ebe5c2494e3ef9ec23b11a8a11bb2f4fbd2d417f2bf2f8d077079ca36f9fe779e7e3804b
-
Filesize
233B
MD590d9629685ca3ab87d060442e8a1620a
SHA1554a797d5c2b153506f37616f9f94567c024f41c
SHA2568413e9ae961cb4b9ff4ae2302b192b2d6ff4e6de657f6fa2b30cec4714335872
SHA512419eb9e3c88262651f36abf5a80ad790259f79b416924513e27c92227d96055101f60bace84c10b28328ba69d1d52f160e143fe30f2456e4113b58b5dcb73b7d
-
Filesize
4KB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
4KB
-
Filesize
5.2MB
-
Filesize
4KB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
160KB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB