Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
09/04/2024, 20:03
General
-
Target
d8d447ad44f1544f279f7732275d3310e84720a3540dd515d46f8b3b7460ce23.exe
-
Size
437KB
-
MD5
cc8f938541333e0fed0acd7fe6483d1a
-
SHA1
5881c25d8a9985d206d39272502e332201f39e38
-
SHA256
d8d447ad44f1544f279f7732275d3310e84720a3540dd515d46f8b3b7460ce23
-
SHA512
53f4d19f58481accb71dc34d97eab9335205346f8b04c49ae366fcbeec79faa4ffbe4ccdebe889c562d7ad63632815197bf189eaae001a79ef52fc3412f226aa
-
SSDEEP
6144:5fweR7gpANB0sv2YYuwfDoOPV1x0GwYpk09RhyQ3ZmC:J1R7gpAwsuvDNP/xyqk09TyCcC
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8d447ad44f1544f279f7732275d3310e84720a3540dd515d46f8b3b7460ce23.exe"C:\Users\Admin\AppData\Local\Temp\d8d447ad44f1544f279f7732275d3310e84720a3540dd515d46f8b3b7460ce23.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Syslemjlija.exe"C:\Users\Admin\AppData\Local\Temp\Syslemjlija.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
437KB
MD5927beed875cc476db084f162cab24acf
SHA1bc01cf2acfc2ca204b8c214da2264584bec38d22
SHA256f1ee8abc1b96f3682f737d4ea0ac498cf9551672a5eba5bc282901243cede289
SHA512982cf25a10303b2e4df0c6ff926e43a9aa6fc7f8633b12b0a4d24d76e857ee38fac2c97fcceb068c6bc946f609971eef9fbbafae6f3e6e49be8c007380791aba
-
Filesize
102B
MD54f5aa2ade9eacb08f365b9c02972130d
SHA1d6b783dc9fccf33f22fd327e146ae873d2bd3d63
SHA25674507b013ce0aa379833cd719feec769fac1ba5589e1570a84f972cf7ad98d27
SHA5123ac0e7344eab13405ce8e7d5d618bcc034a26a4a099dcc025a4a6862f07f74eb6c7edc4c9b03f7a4a4717195499b71c7800a072227d692d2c7b82e84c94fd84a
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB