Overview

overview

10

Static

static

10

e2b858b0b4...cs.exe

windows7-x64

10

e2b858b0b4...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-05-2024 15:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe

  • Size

    431KB

  • MD5

    e2b858b0b40d3d998778e17d00787b10

  • SHA1

    22850999a548a5982a2c145ae74c1a0dc3e42a87

  • SHA256

    9db9ff622a13ce2f91f10aaf7ea77bacb045a2350ef93382766166270f3c813a

  • SHA512

    71323ac9b182eb077eee63586ab70fa5ffd12f6397adbdde983c95d00477d3fb2f2e952281fcec7f901a876cce50477189f886a45bb5dc8839292f835c63a520

  • SSDEEP

    6144:cT5J63Fm3b7yOE7Hvpu5CaGi4mUf95TtC4uP2scqAH:c4Fm3b7yOAHNar4mUf9lJ82scqAH

Score
10/10
blackmoonbankertrojan

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon
  • Detect Blackmoon payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1900
    • C:\Users\Admin\AppData\Local\Temp\Systemmmjxu.exe
      "C:\Users\Admin\AppData\Local\Temp\Systemmmjxu.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3340
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4848

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Systemmmjxu.exe
      Filesize

      431KB

      MD5

      70667cb7d2baf3e33f0643c1cb6d716f

      SHA1

      44914b7c1cff38594d7cf12b303ff7bf962eb36c

      SHA256

      846701ac1470548f9f5294ccabb20bd2af7e8b2d93e146f3c39da520f2d52721

      SHA512

      09e7a11692426cbbb228155abf23b8a2b6a641d2953407e9b630f7f4a22f37424f3435eda129b10dc62ea6e94950ce13f4fd83ca61e8bb7cb79c1d51e72415f1

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\path.ini
      Filesize

      85B

      MD5

      dd1fcfd52e099f2e2f3cb111e94bf33b

      SHA1

      5d333e8dfc6efb61ac9684080a4986838d3e6924

      SHA256

      fb4761df51040f5b4d09733d2cb70b080a7b49998424b1849f37d88dee9be143

      SHA512

      4f42e2b0694684435d662c26e882f3d9cc3c8bb5d5bfed420f454e699f35c64755e3acab43a18f8a97d32884c97ed24e490689644005296e0ead0da227b7242e

      Download Submit