Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
26/05/2024, 07:54
General
-
Target
67721cfffa1bf41a890f6c00d941a50734df69b513c860f6407f6507775235a8.exe
-
Size
15.9MB
-
MD5
2a47ac4afed51f55f3c7756cf062789a
-
SHA1
009a7f1c04093b996307d4e007ec11849cbf2d16
-
SHA256
67721cfffa1bf41a890f6c00d941a50734df69b513c860f6407f6507775235a8
-
SHA512
3ad5beb65d52a7989856e700497ceac95644e1f5400e6cac6ecc983e608a9b65d9249164b03172b9728750ed7793f28a094f0a0790e4988326511e715c275ed3
-
SSDEEP
393216:iOfk5pGNvjasmODLxhLelF3LhAvxg3zRFhF3imrXi:1fk5pGpvPxhLelF3LaK3viAXi
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\67721cfffa1bf41a890f6c00d941a50734df69b513c860f6407f6507775235a8.exe"C:\Users\Admin\AppData\Local\Temp\67721cfffa1bf41a890f6c00d941a50734df69b513c860f6407f6507775235a8.exe"1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\·ãµ¶ÃÔʧ΢¶Ë\1551167721cfffa1bf41a890f6c00d941a50734df69b513c860f6407f6507775235a8.exeC:\·ãµ¶ÃÔʧ΢¶Ë\1551167721cfffa1bf41a890f6c00d941a50734df69b513c860f6407f6507775235a8.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD5a5b4bad223cdce450a03a66e8ddc7fb3
SHA193d33e0a3e243575f85857c9cad55b358b3eac40
SHA256cae78e4f08f9f536c08e7c6ad49a45f593010401a66d8230cf9e7bcd6f11a493
SHA512f61d8fa092feaa1646ba96240455053470598d4c71d59bfd8a5db22b344eadfba773d0558cbbf2672b65b2d89e8c6487a00dd3dbdc3d6241e0d473f682def8a9
-
Filesize
15.9MB
MD52a47ac4afed51f55f3c7756cf062789a
SHA1009a7f1c04093b996307d4e007ec11849cbf2d16
SHA25667721cfffa1bf41a890f6c00d941a50734df69b513c860f6407f6507775235a8
SHA5123ad5beb65d52a7989856e700497ceac95644e1f5400e6cac6ecc983e608a9b65d9249164b03172b9728750ed7793f28a094f0a0790e4988326511e715c275ed3
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.0MB
-
Filesize
12KB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
12KB
-
Filesize
6.0MB
-
Filesize
12KB