Analysis
-
max time kernel
1s -
max time network
7s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
22-05-2024 11:58
Errors
General
-
Target
cfsamdsfzrej_gr/LOL意哥破解版/LOL意哥全能辅助.exe
-
Size
11.4MB
-
MD5
023a521e6cd4e539da30086da993176c
-
SHA1
1f33591e1fe3b5e5daabf903ab44ba52b5f302a1
-
SHA256
fc1125bc588065dfeb94e20bf41ff25db7bd812c8a1b964087f239489ca976f4
-
SHA512
1e2b2a31862587f1ca94149ccd9466fe04bd2b06344866ea9b1c1068a38dc7daec0c668d0558abbffc955d8ab8af5b242f81073fd3508d07249006bb3d81fba9
-
SSDEEP
196608:l7vzAIaW9+1lFgJklVv5CjCDFDADZTIj3FFMAIw+w9GqjYoj0yoXe3:lbzAtWWlFO2AjCD1ADZTIj3IAIw+w9GY
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 4 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
VMProtect packed file 5 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfsamdsfzrej_gr\LOL意哥破解版\LOL意哥全能辅助.exe"C:\Users\Admin\AppData\Local\Temp\cfsamdsfzrej_gr\LOL意哥破解版\LOL意哥全能辅助.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39b4055 /state1:0x41c64e6d1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23.9MB
-
Filesize
968KB
-
Filesize
23.9MB
-
Filesize
80KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
23.9MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
1000KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
23.9MB
-
Filesize
23.9MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB