Analysis
-
max time kernel
121s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
12/01/2024, 07:37
General
-
Target
b0b9660a8e6ebf228822547ddf57c17a932f9c920d127cb3b64b32c9b9504d1a.exe
-
Size
1.0MB
-
MD5
976dae784d588e83d2b982440a0b49b2
-
SHA1
2e89b01466d41ad56ab94d0d26d2bda5278fbde7
-
SHA256
b0b9660a8e6ebf228822547ddf57c17a932f9c920d127cb3b64b32c9b9504d1a
-
SHA512
d6b0ebbf47b47ccfceb7438e83b8d12c1595000075bdd1fd5df982ee298deca472f075a6d504096d9bb74b4f8ee5c18cb8033e6f8682b812deaeb4601d01c6c7
-
SSDEEP
24576:hlR3W+VUl+iJyv4kNENUkGIO3kaCkspl2L5J:hl0+Vi+iA9KNmVC1GL
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 38 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0b9660a8e6ebf228822547ddf57c17a932f9c920d127cb3b64b32c9b9504d1a.exe"C:\Users\Admin\AppData\Local\Temp\b0b9660a8e6ebf228822547ddf57c17a932f9c920d127cb3b64b32c9b9504d1a.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\helppane.exeC:\Windows\helppane.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\tpqvms\Agghosts.exe"C:\tpqvms\Agghosts.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD55aab297fa8f143bfa67310ad78b76d3f
SHA15db963c2cca1bc8c8c060c52f7df76ccb477f01a
SHA2568ec64bc55e5641d7683288e5e8e27c9391f06eb4da096c3d677d8f25ca4d04df
SHA512c1ee67bd4c6bcfdc4179f905c7abc4ac632c9265b61dd5fdb90eeeec39802abe2cc487a5c8ded8a0748728104170c1b4d3a88904f102e1c3f891fac7702a2256
-
Filesize
215KB
MD50d1e7a90ae0df082e9da031379a4e939
SHA1db5e7d7bb6d8e2290cc7d1650030e0828d2745ba
SHA2561bd3ddf276473fb64192b735b2dc5b9b061a4717643b7ed2d49d3c77bbd4dd6d
SHA5123d303d8bfc9f428e726db281aa82ef383c6172bb5901710f8d9049cc4ed474a02b42bd747196999384a9d4e3788f49e57b18163d670c6e111264e435c84a9cdb
-
Filesize
512KB
MD527409998a5047ed2ddbb99e6676ef7ec
SHA117e510effffeef9a1556cd28ea3ccde39ec06599
SHA256d2966e08d8f1077cb9c2bcdb570f1136b5173f8c42f01cfd240b51f69ae7bcf8
SHA5123f4807689ef5dfcc70398fada056917f00551f99053749ea5f886a4d0b75b91556cc4a9d1c1de2058652734cf461e1f85f5d7ef78d3fc1dca36c7f8e87fb38e5
-
Filesize
15KB
MD5035a5066cb9371f56278eb18ad984ab1
SHA142acd17ecc8b55f0e72d4158f48f829ffb43d5e8
SHA256210e69778c43fa2126ee7b39f1feae0fe58e08ea829781872c07fcc1b39b7566
SHA512f22661577eb834e3b5954fa3420c61b52b20af0f34eb71a43ac35373ab16cc69285d2f7aa5d64f4efe293a39915a7ec3e7924115335f493910a1db867e11eeb9
-
Filesize
77KB
MD5f107a3c7371c4543bd3908ba729dd2db
SHA1af8e7e8f446de74db2f31d532e46eab8bbf41e0a
SHA25600df0901c101254525a219d93ff1830da3a20d3f14bc323354d8d5fee5854ec0
SHA512fd776f8ceaac498f4f44819794c0fa89224712a8c476819ffc76ba4c7ff4caa9b360b9d299d9df7965387e5bbcb330f316f53759b5146a73b27a5f2e964c3530
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
4KB
