Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 23:05
General
-
Target
c36be1f8258236caaa5c0b0098aee46a516abe69d8e4c9a7f9a68cf166e88a33.exe
-
Size
12.0MB
-
MD5
70eea6793a54bf70b0b21a1b71628db5
-
SHA1
3a945d2cca69e4f77a517f28950f276e923671c0
-
SHA256
c36be1f8258236caaa5c0b0098aee46a516abe69d8e4c9a7f9a68cf166e88a33
-
SHA512
1126ceb4b2ffa425afda6ebf34b0041f9d7295dc37bab1ecb3d114e93c687d6256b1247298447c728314de6915451b186a6447df309e8acf2b70aec475f5a619
-
SSDEEP
196608:FmBGRP4hinoELBn8M9wr+weWKBT0CYjD0LAif8dxVK1W2HfALaCIwZrFKTNeFpPW:FmtInxJ8MfzWQ0pjAXa0hfA1whev
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 5 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c36be1f8258236caaa5c0b0098aee46a516abe69d8e4c9a7f9a68cf166e88a33.exe"C:\Users\Admin\AppData\Local\Temp\c36be1f8258236caaa5c0b0098aee46a516abe69d8e4c9a7f9a68cf166e88a33.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4520-7-0x00000000036F0000-0x00000000036F1000-memory.dmpFilesize
4KB
-
memory/4520-6-0x00000000036E0000-0x00000000036E1000-memory.dmpFilesize
4KB
-
memory/4520-5-0x00000000006E1000-0x0000000000CFB000-memory.dmpFilesize
6.1MB
-
memory/4520-4-0x00000000036D0000-0x00000000036D1000-memory.dmpFilesize
4KB
-
memory/4520-11-0x0000000000400000-0x0000000001904000-memory.dmpFilesize
21.0MB
-
memory/4520-3-0x00000000036C0000-0x00000000036C1000-memory.dmpFilesize
4KB
-
memory/4520-2-0x0000000003690000-0x0000000003691000-memory.dmpFilesize
4KB
-
memory/4520-1-0x0000000003680000-0x0000000003681000-memory.dmpFilesize
4KB
-
memory/4520-0-0x0000000001A80000-0x0000000001A81000-memory.dmpFilesize
4KB
-
memory/4520-12-0x0000000000400000-0x0000000001904000-memory.dmpFilesize
21.0MB
-
memory/4520-13-0x0000000000400000-0x0000000001904000-memory.dmpFilesize
21.0MB
-
memory/4520-14-0x0000000000400000-0x0000000001904000-memory.dmpFilesize
21.0MB
-
memory/4520-15-0x0000000003D60000-0x0000000003D96000-memory.dmpFilesize
216KB
-
memory/4520-16-0x0000000000400000-0x0000000001904000-memory.dmpFilesize
21.0MB
-
memory/4520-17-0x0000000003D60000-0x0000000003D96000-memory.dmpFilesize
216KB
-
memory/4520-18-0x00000000006E1000-0x0000000000CFB000-memory.dmpFilesize
6.1MB