Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
17/04/2024, 04:30
General
-
Target
ee82cc3d73179d2d8f94cd8bc30376af7457407e6e450b81f67aac7965a8d8ee.exe
-
Size
1.9MB
-
MD5
b79fdfa22a1ec7d64e3475006e3355bf
-
SHA1
f7bf622ccb4ed8ef32dd894de9bdd408450e0ddc
-
SHA256
ee82cc3d73179d2d8f94cd8bc30376af7457407e6e450b81f67aac7965a8d8ee
-
SHA512
3286d38312243b19f81112431d556a0eba03dbbc6ce9c6b09dce5d7268e50a46fa35a2e04218f6a045ab9baf5edc3aaca62cab9a5b69d87a43feb9aa937408f6
-
SSDEEP
24576:K3M7V45iensGYO1WVNKnXJIT/49r9L55ZsyjJMZ7NXxD+hUnbfB9gZGbx7bQr:Kx5mGYOqNKnXaT/49r92yjAdxD+uY2
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee82cc3d73179d2d8f94cd8bc30376af7457407e6e450b81f67aac7965a8d8ee.exe"C:\Users\Admin\AppData\Local\Temp\ee82cc3d73179d2d8f94cd8bc30376af7457407e6e450b81f67aac7965a8d8ee.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\CDM.exe"C:\CDM.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
884KB
MD5beb1ea045490ba658f11b9f564e50068
SHA1f59e4c154ce2a5337ee2bdd188b54d8dd9558608
SHA2563cfdf483152500ae8c0ceae673e017450acf06e41ff3dc8fd72af1d916b61b12
SHA51237422f122ff9616aa74f341215e4bef30b1a324fae37ce7286f53f5b656a08c909001890a3d17be00c3870393483bdcd42891094a34a05783f2537e79883fb5e
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB