Analysis
-
max time kernel
148s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
24-05-2024 20:03
General
-
Target
2c25c74f6e95c83d05b38ff18490593a82ab252c81861637dc0a1bdeb2172b6e.exe
-
Size
437KB
-
MD5
18d3cb423bfa0e317a2c0445ebbb42c9
-
SHA1
dd6f79916556fc50828e419f25e6a2cb627f5573
-
SHA256
2c25c74f6e95c83d05b38ff18490593a82ab252c81861637dc0a1bdeb2172b6e
-
SHA512
1ef4c736f52bb325d5cffb3624336f0b0bfa61833bfa34ac69cbbd9d5a1ccc5cdd8c618e60c15eeab4d5c5ad78bd2175aa3d71ec595d03d69dc1df25e81b81dd
-
SSDEEP
6144:5fweR7gpANB0sv2YYuwfDoOPV1x0GwYpk09RhyQ3ZmF:J1R7gpAwsuvDNP/xyqk09TyCcF
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c25c74f6e95c83d05b38ff18490593a82ab252c81861637dc0a1bdeb2172b6e.exe"C:\Users\Admin\AppData\Local\Temp\2c25c74f6e95c83d05b38ff18490593a82ab252c81861637dc0a1bdeb2172b6e.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Syslemynqzv.exe"C:\Users\Admin\AppData\Local\Temp\Syslemynqzv.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\lpath.iniFilesize
102B
MD52bce186fd9fdf1b1da21867af5d887ae
SHA16cf48b04bf6d1691f5a3e0cebbc9c384ae1b8a5a
SHA256357f1cae869490082f810544d18cb41cf5104edba61443ce695fe7ed108bf515
SHA51200804b2dc4ee22dff47e5ba5d4f1cfb113bfdbe9491a49be202aba6ef018f75b81ed5dd57b6d173d412ecb0f89326b69a08278e608b229c534d1a21ab5dff22e
-
\Users\Admin\AppData\Local\Temp\Syslemynqzv.exeFilesize
438KB
MD5420c4435ca2db93a92578f992d1e06d5
SHA11b050f0f437fb9e45590a787b2ef7823ae19d148
SHA256797619a2d95bd48645be6be29b4827fc85931056e2e9d91765e08f583dbdb97d
SHA512d21444f2672ad84b30dfcec6dfe820ac12447a80bf3ba3899821176fc98c01927320d89eb19a639e6ba35d52e4b7fd0e9e4707bb088d0f0d3270c8d3b4f56f4d
-
memory/2240-0-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/2240-14-0x00000000038B0000-0x0000000003920000-memory.dmpFilesize
448KB
-
memory/2240-18-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/2676-16-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/2676-20-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB