Analysis

  • max time kernel
    148s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06-06-2024 02:27

General

  • Target

    8c0eb32d1723a6dbd01c696dc81a9f308cf4f0c0d5d4a45b385b2f333e436484.exe

  • Size

    88KB

  • MD5

    4ee6e1dd5421d315522f609d181e8ff2

  • SHA1

    e6a5f48b98bb64e30bf5f64f4c8421b711f1fa0e

  • SHA256

    8c0eb32d1723a6dbd01c696dc81a9f308cf4f0c0d5d4a45b385b2f333e436484

  • SHA512

    be37bd8c28798a0ebbbfcfd86e297cf7aab10c603dcf3d7bb571ed59103cd24a207ab5332df6055ccb751882d4e8be62bb9f6f22e1058980f5c3f2f47099b541

  • SSDEEP

    1536:EF7p8VeHwYaBlAvXhRDtxY11686va0QgE9gHgMVnvLiDXs+T:K98VNTAP3BW1k81cLAUvLiDXss

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 2 IoCs
  • UPX dump on OEP (original entry point) 5 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8c0eb32d1723a6dbd01c696dc81a9f308cf4f0c0d5d4a45b385b2f333e436484.exe
    "C:\Users\Admin\AppData\Local\Temp\8c0eb32d1723a6dbd01c696dc81a9f308cf4f0c0d5d4a45b385b2f333e436484.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2324
    • C:\Users\Admin\AppData\Local\Temp\Syslemjlpur.exe
      "C:\Users\Admin\AppData\Local\Temp\Syslemjlpur.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2584

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\lpath.ini

    Filesize

    102B

    MD5

    f0b19345292cdf6045d0fe3d16377185

    SHA1

    d4dce3873b31ead3a7d4a9936dc313e1cf867018

    SHA256

    c05b66788960be8eeda29104f31846c2161a025880873dddcb4b87c7b9216b34

    SHA512

    2a0219c4ee524a4146c9a404a5d7aac35f394b5f184e45d82d5f7f1eeab07e9167cdb31fcf5c147c555a31d8558d7be3aa6e1aee0215c11036821af040d1b077

  • \Users\Admin\AppData\Local\Temp\Syslemjlpur.exe

    Filesize

    88KB

    MD5

    45b63a3dd97070a8265bbd4eb028e6c3

    SHA1

    1282e558adc01e6160f3a0bf017e9f3bfc6196ec

    SHA256

    d3dc441686d5aaf506910dbfb588ff14dbb39f300124d3cb03af693ee46e5d38

    SHA512

    002e84a7efd48066a6fada1f2d4d108a2362cdf0bb6ca279e304ad80945312349a7de842910673dde1d86f9805573c05cc53daa2e3704fd2576b57f34a593f2c

  • memory/2324-0-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2324-10-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2324-15-0x0000000003550000-0x00000000035CF000-memory.dmp

    Filesize

    508KB

  • memory/2584-17-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2584-21-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB