Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

5d5d24574f...6c.exe

windows7-x64

10

5d5d24574f...6c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/03/2024, 09:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5d5d24574f56e090d0bc8a753fdb8e56c2e0232d368d696459e0333b4e34626c.exe

  • Size

    145KB

  • MD5

    16c2b2255bf7e1a687b6ddc4f99fca81

  • SHA1

    a78332c7802b8eeb59439e4d1de3f9eba955c355

  • SHA256

    5d5d24574f56e090d0bc8a753fdb8e56c2e0232d368d696459e0333b4e34626c

  • SHA512

    6cdb43b9c37d9f654de8ec0c5608c6c6ac7436c1d6950a72c898bdaca163ab362b845fcc776107a787918690ca1959b3a13cceaa1eea4e0e5de019225013b57d

  • SSDEEP

    3072:WWWX0E6LJjGF+dtoj84/9rOnt/cA6QIjeyuuI+4:WmJ4+Tj4/QSA6QI07

Score
10/10
blackmoonbankertrojanupx

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon
  • Detect Blackmoon payload 2 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in System32 directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5d5d24574f56e090d0bc8a753fdb8e56c2e0232d368d696459e0333b4e34626c.exe
    "C:\Users\Admin\AppData\Local\Temp\5d5d24574f56e090d0bc8a753fdb8e56c2e0232d368d696459e0333b4e34626c.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2536
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\cntjfw.exe -U:C -P:E -M:S C:\Users\Admin\AppData\Local\Temp\itmrqz.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2248
      • C:\Users\Admin\AppData\Local\Temp\cntjfw.exe
        C:\Users\Admin\AppData\Local\Temp\cntjfw.exe -U:C -P:E -M:S C:\Users\Admin\AppData\Local\Temp\itmrqz.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:60

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\cntjfw.exe
    Filesize

    156KB

    MD5

    7aacfd85b8dff0aa6867bede82cfd147

    SHA1

    e783f6d4b754ea8424699203b8831bdc9cbdd4e6

    SHA256

    871e4f28fe39bcad8d295ae46e148be458778c0195ed660b7db18eb595d00bd8

    SHA512

    59cce358c125368dc5735a28960ddb7ee49835ca19f44255a7ae858ddd8a2db68c72c3f6818eca3678d989041043876e339f9fafe1d81d26001286494a8014f0

    Download Submit

  • memory/2536-0-0x0000000000400000-0x0000000000489000-memory.dmp

    Filesize

    548KB

    Download

  • memory/2536-1-0x0000000000400000-0x0000000000489000-memory.dmp

    Filesize

    548KB

    Download

  • memory/2536-10-0x0000000000400000-0x0000000000489000-memory.dmp

    Filesize

    548KB

    Download