Overview

overview

10

Static

static

10

d037678d81...ca.exe

windows7-x64

10

d037678d81...ca.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-04-2024 12:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d037678d81708397aa4e82d68d810503b8b04223a1470eea406b7b7b73aca3ca.exe

  • Size

    396KB

  • MD5

    ec221c0b18e1e431bda3c714a45db18f

  • SHA1

    96b694c61f696110bdf5441ca63a0456382505ec

  • SHA256

    d037678d81708397aa4e82d68d810503b8b04223a1470eea406b7b7b73aca3ca

  • SHA512

    f4909e34dfcc2a105e39b544f6d98925b57baef30979bc99cb308efda3c537ec460af0fa6271ca97cfd146754524e152300ba2fe3dd52b40b1269f13d4d5bf0c

  • SSDEEP

    6144:7vbuWQu/cuaS2l8iE0B55FrJJJekPdb5J22u:7vqWQub2lrE0B55FpekPdb/22u

Score
10/10
blackmoonbankertrojan

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon
  • Detect Blackmoon payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d037678d81708397aa4e82d68d810503b8b04223a1470eea406b7b7b73aca3ca.exe
    "C:\Users\Admin\AppData\Local\Temp\d037678d81708397aa4e82d68d810503b8b04223a1470eea406b7b7b73aca3ca.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3248
    • C:\Users\Admin\AppData\Local\Temp\Syslemmpgqo.exe
      "C:\Users\Admin\AppData\Local\Temp\Syslemmpgqo.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:756

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Syslemmpgqo.exe
    Filesize

    396KB

    MD5

    839d60ac2ddfbe4359d66138e569e641

    SHA1

    cce83cab7e712b96ab4541d31a40ee2e5e4c3200

    SHA256

    1a6d6aba1c7c3baf07693e27253cc887e131edc60bcb6e3b53273c2aa3fc24bf

    SHA512

    bdd8c6adb0414950283be1bb14ce862cf3f3b34c9769b57f676c12640f517599de05ec74875ce45b316a67fc212c719a2e1c573ab0b4c9f3c10c8f8e8cadce99

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\lpath.ini
    Filesize

    102B

    MD5

    40c9ef1275e833f97137c1cec6acd13a

    SHA1

    2fa374bd947cf7ef12c957f2507a28b48ed9c199

    SHA256

    41608f820d8a4c64439ceecfcd17aa8b54b69b790e75f8994c89981aaf597c81

    SHA512

    83f18b69516aca15d5e8b7d8db883e142b3335c896780a3c085c75382fe964ed64d66afaf422d6eff5a34241bfc4a1dddd54e5efa5eb65fdc83d718a9909116b

    Download Submit