Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
14/01/2024, 07:31
General
-
Target
e59e2344bb5f2e9a8f4e69247d20cb6501687a0d6b85ef89571b8082f4a3801a.exe
-
Size
4.3MB
-
MD5
e69f75c4add5562c23c24e8b199b4d25
-
SHA1
569a6e7f4f4595653bc1bf7e93b1d2c358b0ef77
-
SHA256
e59e2344bb5f2e9a8f4e69247d20cb6501687a0d6b85ef89571b8082f4a3801a
-
SHA512
ad9062028c9de45a17e0138bda92992048dba232a5e165c64060a99715a29fa96c3c3c0b4ebb7eed4fea6eea3a3483516f9f2516a9325b9c4e2e2dc022770d29
-
SSDEEP
98304:CLSs9c4yYZIVSEa02Qh/dgrGz4tuMPBRwJkWuO1RGOjYc4+kulZ:w9crVSEu2dgrztuMPjSWOP6KlZ
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 4 IoCs
-
Loads dropped DLL 5 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e59e2344bb5f2e9a8f4e69247d20cb6501687a0d6b85ef89571b8082f4a3801a.exe"C:\Users\Admin\AppData\Local\Temp\e59e2344bb5f2e9a8f4e69247d20cb6501687a0d6b85ef89571b8082f4a3801a.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f8 0x3341⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
320KB
MD58c68c0a08c220f94c7fc4c4fb75d0744
SHA14216011fc009592901c1ede16d97835422f62909
SHA256e337af5620e64bc05699caf0a76d6d18c66cab3582a0f648f8396fb62e2e04ed
SHA512b9dd1df595b6f05217aed0d13efe216832ff4e8281337b910d667aa4293cefaa55e59f0c9c1fe3080e9673176db931a05faa273e485c078e0564e34dff419dfb
-
Filesize
323KB
MD5460a62e64e6ddf5c768eee2075daf894
SHA1e7c067159f4de4f5ec8c2db4ebd1f2c4bae1e14e
SHA256d554a0350db44787f16b93aee60c2d2c1dafe09089c4e270aacfc6894086c543
SHA5120cfb33bd5b00a221c77d628ea252f2f4001ccf33b08f0b25a930c1c1e30dac2d65148b63cb07ebde178d74ada827ef64014e4c180387d9fdb9e18614081c7663
-
Filesize
116KB
MD5f376fc102edbbaa7a88c005eb519c198
SHA1f36b0fce36838655b13e95c3895bebc868c3544b
SHA25609183fb6a2b1ae537804f475b35647758b83c0e6cafe2573dd5c710c64e9c0b0
SHA5123d07bc58640dfef0768d12f5944f3fd8c050f92e9a794dcbfe16c6e66b87b07489555030f20e969d9d62bb4e9f7e050402391dd1c1667dea36db147807c799c7
-
Filesize
10KB
MD5492be3d37b0e8fe74ca3afc41e18e6ce
SHA119a265ca3b5fb2e971d14f8d04d20f4277faa906
SHA2566c7fa2316ce154231710387a22e014afdb24cfb4215d29feca76a2b0a9734949
SHA5122bea1e149cc35e3bcfc93d19d0e5c09e275ec2d07f322ffb9d3b1873a12329ef86bbe5f00e9dbe5b748a3210d4613f3a94e15e8857b44f382e45de4a0b70a2cb
-
Filesize
25KB
MD5673c66811cd6913eda4ca762811c34ff
SHA156c78f8d7abc294bab9eeb38567eee0c76a2101b
SHA256843e9267448773cf21d8ec1027a2dc66c0d5ad428e72af8393d5bc342ee9e6d5
SHA512e7a565c293ccf79538d802198497011b0fd9445eba958cbba89d34c3bda2b8e58ccbfd7e561536880ba12618fc3a9c25a4aff55dcb840ff6d0f93617c8769183
-
Filesize
429KB
MD5db4e7b05b51bf179b9852b3e9667aa4d
SHA10102fd2d9aaa199b568da307929f4bcfa7f2f479
SHA25603c19157f4abff9985017c87b4686588b9860c9832c79f524d884e5c4d39ca88
SHA5123379cc2582fe74c5579b5bb3d879b19ef910ac7efaa641809986bcc6e2f7362a128b502f4e4550ae82768625551797d38e8c33688869dbe49b39dc059adb6ebd
-
Filesize
116KB
-
Filesize
4KB
-
Filesize
11.2MB
-
Filesize
4KB
-
Filesize
668KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
11.2MB
-
Filesize
308KB
-
Filesize
11.2MB
-
Filesize
11.2MB
-
Filesize
116KB
-
Filesize
1024KB