Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
26/05/2024, 10:32
General
-
Target
0dbff9893ecbaea8dd5c7b1c14f786c7762fa5977e1c3f2e7aa24e9864c8f02d.exe
-
Size
15.2MB
-
MD5
3f312ca7f4bcf842229d1fae83a15508
-
SHA1
a3a23d5d78ed165ca89074b03ccf512f6c1356fa
-
SHA256
0dbff9893ecbaea8dd5c7b1c14f786c7762fa5977e1c3f2e7aa24e9864c8f02d
-
SHA512
98515d12d7ea835e9284e82c4e725fba8063fb91d2a7d91a038dfd34727eea80453fd623f79f71fc3f241bd7a7572b93598a4a9ae9ffcd8828029fffa31dfb7e
-
SSDEEP
393216:UnzpGNvEesnRYXM9i3lDEm3OZ5DMGB//ehu2Ap:UpG8Yc6lDEmagGB+hEp
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 14 IoCs
-
ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0dbff9893ecbaea8dd5c7b1c14f786c7762fa5977e1c3f2e7aa24e9864c8f02d.exe"C:\Users\Admin\AppData\Local\Temp\0dbff9893ecbaea8dd5c7b1c14f786c7762fa5977e1c3f2e7aa24e9864c8f02d.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\¿ñ±©¸´¹Å΢¶Ë\331650dbff9893ecbaea8dd5c7b1c14f786c7762fa5977e1c3f2e7aa24e9864c8f02d.exeC:\¿ñ±©¸´¹Å΢¶Ë\331650dbff9893ecbaea8dd5c7b1c14f786c7762fa5977e1c3f2e7aa24e9864c8f02d.exe2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5e3e4a98353f119b80b323302f26b78fa
SHA120ee35a370cdd3a8a7d04b506410300fd0a6a864
SHA2569466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66
SHA512d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee
-
Filesize
8KB
MD53f57b781cb3ef114dd0b665151571b7b
SHA1ce6a63f996df3a1cccb81720e21204b825e0238c
SHA25646e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad
SHA5128cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa
-
Filesize
16B
MD5b91510551ee8087e3656a00830dd3631
SHA1974a9f3568ed8cc73b83ed149353de2a6e9f12cb
SHA2567bdcf482e509c29247a87fc982167ab38460a24abf62e0409500b0f0eacb9a35
SHA512b0823f8921cfb40a40ac1075d351d28457976ac7ac4db55f57436f39b9c34065289ecdc73f21df2122093c575a74510c9802e2027eb2a9ddb65ae01a73f1548a
-
Filesize
15.2MB
MD53f312ca7f4bcf842229d1fae83a15508
SHA1a3a23d5d78ed165ca89074b03ccf512f6c1356fa
SHA2560dbff9893ecbaea8dd5c7b1c14f786c7762fa5977e1c3f2e7aa24e9864c8f02d
SHA51298515d12d7ea835e9284e82c4e725fba8063fb91d2a7d91a038dfd34727eea80453fd623f79f71fc3f241bd7a7572b93598a4a9ae9ffcd8828029fffa31dfb7e
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
4KB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB