Analysis
-
max time kernel
156s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
09/04/2024, 20:01
General
-
Target
72aa8d18265109bfa5401eff0108e55dc59e3334aa278e54e00bb3718a0212a3.exe
-
Size
452KB
-
MD5
c38910ed1d6f156a07c59b1d8b5164ba
-
SHA1
76993b99f5a438879bff258d7eb2203533e3681f
-
SHA256
72aa8d18265109bfa5401eff0108e55dc59e3334aa278e54e00bb3718a0212a3
-
SHA512
6946789b6d58bb58d1992e9388965cad25a6a5b10a874738d6dccd74120ee322d76985305410af1b412eb2d996abcab42b414ef9a528d11084d685af33f81183
-
SSDEEP
6144:/vPBvEQR6H3Udg2FuHRfepwqHpA7b2+yO2COKCZy:/vpv/R6H3U25fehHpAW+yOBOKCZy
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\72aa8d18265109bfa5401eff0108e55dc59e3334aa278e54e00bb3718a0212a3.exe"C:\Users\Admin\AppData\Local\Temp\72aa8d18265109bfa5401eff0108e55dc59e3334aa278e54e00bb3718a0212a3.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\elxplorergnyob.exe"C:\Users\Admin\AppData\Local\Temp\elxplorergnyob.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
452KB
MD53106e65d64ab3451f0e8166d917dd380
SHA14e741230efb841ffc6e3f35e8d9b43f98466c920
SHA256a10bcc31e883fe6349e3745342c029814cfcde753bc9e5ea6c08799a62e8e9e3
SHA512a0d45847da850cd0d388a56120da2a35169e9b063394ca5444f63d967f3c4647fe19a72c76d4c2c6a73c164e9f4568055ec1fa18b710f646123dc2c467be82ea
-
Filesize
102B
MD5b031d4439d83d83f9a0f25803a5d6f6d
SHA12bd444bdb10eca71aa20aeeb65ac25bf06d52e2a
SHA2562e17386ca019cff5757015385d4cbbd39ff2834a6bf542e0d883c871ad188fa0
SHA512c5b3a8155f1a46da8968a8e1d98725f942cd07b04356d3336c47ea0b3a4dd1dc726084a62fd71faa1d2e9d19817bd13300b8cafbe7d2434e8803fc276e236ed0
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB