Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
24-05-2024 02:35
General
-
Target
88f2c932b70a532e7ac7173a7ff9de11c27caaa514dc8019cb6319d0b0b88aba.exe
-
Size
10.2MB
-
MD5
4da32f1f0b1dac90157f53b293a95f08
-
SHA1
acbeb60776e715cea2e06d79d2608446919789de
-
SHA256
88f2c932b70a532e7ac7173a7ff9de11c27caaa514dc8019cb6319d0b0b88aba
-
SHA512
1b93e41cc5c8c8a4d02c4cea18f46f48a7c74511b69c1b2677e1e320cf6fe8ac803d3dd0654c3349ca5009b06ea0bc9fb5cd300e10981e77057ba73cb4e22c13
-
SSDEEP
196608:A8FHCu5uL1zRjyrQpcs+TYm3El87p8oF6eQoIK5CsC0H1F/oeVOX:VHn5uerQp1iEO7R6PK5CsC0z
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 1 IoCs
-
Executes dropped EXE 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\88f2c932b70a532e7ac7173a7ff9de11c27caaa514dc8019cb6319d0b0b88aba.exe"C:\Users\Admin\AppData\Local\Temp\88f2c932b70a532e7ac7173a7ff9de11c27caaa514dc8019cb6319d0b0b88aba.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
F:\²Ôñ·µÀ¶ÜºÏ»÷(΢¶Ë)\88f2c932b70a532e7ac7173a7ff9de11c27caaa514dc8019cb6319d0b0b88aba.exe"F:\²Ôñ·µÀ¶ÜºÏ»÷(΢¶Ë)\88f2c932b70a532e7ac7173a7ff9de11c27caaa514dc8019cb6319d0b0b88aba.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
F:\²Ôñ·µÀ¶ÜºÏ»÷(΢¶Ë)\²Ôñ·µÀ¶ÜºÏ»÷.exe"F:\²Ôñ·µÀ¶ÜºÏ»÷(΢¶Ë)\²Ôñ·µÀ¶ÜºÏ»÷.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\²Ôñ·µÀ¶ÜºÏ»÷(΢¶Ë)\88f2c932b70a532e7ac7173a7ff9de11c27caaa514dc8019cb6319d0b0b88aba.exeFilesize
10.2MB
MD54da32f1f0b1dac90157f53b293a95f08
SHA1acbeb60776e715cea2e06d79d2608446919789de
SHA25688f2c932b70a532e7ac7173a7ff9de11c27caaa514dc8019cb6319d0b0b88aba
SHA5121b93e41cc5c8c8a4d02c4cea18f46f48a7c74511b69c1b2677e1e320cf6fe8ac803d3dd0654c3349ca5009b06ea0bc9fb5cd300e10981e77057ba73cb4e22c13
-
F:\²Ôñ·µÀ¶ÜºÏ»÷(΢¶Ë)\²Ôñ·µÀ¶ÜºÏ»÷.exeFilesize
4.7MB
MD5f96754818d770694ce2ee5116f2540e1
SHA1831a7ae3a870b1e26b175975f7107dd2d753b79b
SHA256b2a709c49dd9221e4d78d54e369de7a8510a32cb2193c2a52e95e33cc1810c05
SHA51275f0b043835fa7f2d16113e5b5a45b113a85750197720c85768196467175c0a29d570ff884b3fd868428446743e481d8d5e01b592070435b5db548a5a6635d8a
-
memory/2064-3-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2064-37-0x000000000138E000-0x00000000016A8000-memory.dmpFilesize
3.1MB
-
memory/2064-30-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/2064-28-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/2064-25-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/2064-23-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/2064-42-0x0000000010000000-0x0000000010024000-memory.dmpFilesize
144KB
-
memory/2064-18-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2064-15-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2064-13-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2064-10-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2064-8-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2064-6-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2064-5-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2064-0-0x0000000000400000-0x00000000020D5000-memory.dmpFilesize
28.8MB
-
memory/2064-35-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2064-20-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2064-38-0x0000000000400000-0x00000000020D5000-memory.dmpFilesize
28.8MB
-
memory/2064-41-0x00000000002F0000-0x00000000002F8000-memory.dmpFilesize
32KB
-
memory/2064-40-0x00000000002E0000-0x00000000002EB000-memory.dmpFilesize
44KB
-
memory/2064-39-0x00000000002D0000-0x00000000002DB000-memory.dmpFilesize
44KB
-
memory/2064-43-0x0000000000400000-0x00000000020D5000-memory.dmpFilesize
28.8MB
-
memory/2064-31-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2064-44-0x0000000000400000-0x00000000020D5000-memory.dmpFilesize
28.8MB
-
memory/2064-46-0x0000000000400000-0x00000000020D5000-memory.dmpFilesize
28.8MB
-
memory/2064-33-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2064-54-0x00000000044A0000-0x0000000006175000-memory.dmpFilesize
28.8MB
-
memory/2064-53-0x0000000000400000-0x00000000020D5000-memory.dmpFilesize
28.8MB
-
memory/2064-55-0x000000000138E000-0x00000000016A8000-memory.dmpFilesize
3.1MB
-
memory/2064-1-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2664-103-0x0000000003BA0000-0x0000000003BB0000-memory.dmpFilesize
64KB
-
memory/2664-120-0x0000000000400000-0x00000000020D5000-memory.dmpFilesize
28.8MB