Analysis
-
max time kernel
142s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
06-06-2024 20:44
General
-
Target
2e55a70b6d6f034d896fdf79ea90dc45c1161a59b40b25eb8d64e750a05c3e75.exe
-
Size
1.2MB
-
MD5
16ba079f5e5ee04b207e0ffcf1ba7271
-
SHA1
81a072360800921be0634f0774f79f7477c8b6bc
-
SHA256
2e55a70b6d6f034d896fdf79ea90dc45c1161a59b40b25eb8d64e750a05c3e75
-
SHA512
1abaeda639fc59e9c9638688baad4b38ce98f8bb513ddf1ad3394e29abd9071e1be1dba6081646377d03305dde82c5eca463a00228baefe2ce09045b752cbd4e
-
SSDEEP
24576:oShIpwiu4A9XGhqSv81OuB8FoXWCf8hc+LSjv8k5teLGoqaebhaUG:obpwiu4YXIdkkW8FoGCf8hZWhXaMha
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 5 IoCs
-
UPX dump on OEP (original entry point) 44 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 14 IoCs
-
UPX packed file 44 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e55a70b6d6f034d896fdf79ea90dc45c1161a59b40b25eb8d64e750a05c3e75.exe"C:\Users\Admin\AppData\Local\Temp\2e55a70b6d6f034d896fdf79ea90dc45c1161a59b40b25eb8d64e750a05c3e75.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\data\UpDate.exeC:\Users\Admin\AppData\Local\Temp\data\UpDate.exe 8.1 %43%3A%5C%55%73%65%72%73%5C%41%64%6D%69%6E%5C%41%70%70%44%61%74%61%5C%4C%6F%63%61%6C%5C%54%65%6D%70%5C%32%65%35%35%61%37%30%62%36%64%36%66%30%33%34%64%38%39%36%66%64%66%37%39%65%61%39%30%64%63%34%35%63%31%31%36%31%61%35%39%62%34%30%62%32%35%65%62%38%64%36%34%65%37%35%30%61%30%35%63%33%65%37%35%2E%65%78%65 ¼Ù http://bubusoft.dbankcloud.com/QQ%E5%8A%A8%E6%80%81%E6%89%B9%E9%87%8F%E8%B5%9E/%E7%A7%92%E8%AF%84%E7%A7%92%E8%B5%9E.txt2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2e55a70b6d6f034d896fdf79ea90dc45c1161a59b40b25eb8d64e750a05c3e75.exeC:\Users\Admin\AppData\Local\Temp\2e55a70b6d6f034d896fdf79ea90dc45c1161a59b40b25eb8d64e750a05c3e75.exe ÃüÁîÆô¶¯3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\data\Bugreport.dllC:\Users\Admin\AppData\Local\Temp\data\Bugreport.dll %42%75%67%72%65%70%6F%72%74 %E7%A7%92%E8%AF%84%E7%A7%92%204⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52B
MD5fc76a9a7d881844c575660bb7f8275eb
SHA15dd87916163e409fea6bd89d1ce3c61f20faaee0
SHA256cfcaabd85f70ba4bd5618d350aa6a4bb160c269108afb78be8c8148a4d9c0f52
SHA5123f2ea0aef0e99e89239effc47693189a826a36698b16e1381f33877ef34fa95a3495b1366cf566ca97239df0d4857e892eff27d4624244447844ec230a1ba34f
-
Filesize
299B
MD5f85843b50593a59baf3332f78b8939ec
SHA15e1a5222e5608d792ee4a086fc3227ab9a9453ca
SHA256191330183a08f145422cbe70dc664ac84ee99bfda2986ad5a0ed61bd02b978c8
SHA51229cc29b146f00e6a22a580368fa144955a3bc232c5dfccabf301d4474695633cfeef942540d953d65b94ef027a982055fed0c526c37bd761f2e695cd5d6c1e0a
-
Filesize
1.2MB
MD5c5f3c4f0cdcc5b7702433ee9166b6596
SHA1e0c644a43c65c58fe3edb9570b589cbcfa1ecebc
SHA256922e64425aeefe8c4dfdc831ef7f7e7c02064ba92bc40e4073c0068a8f5c25f8
SHA512909a07e0f5687e636b9b4befb2dc76bd69087d875fcff00b89e09280b752c502ac875bac74a506aad6839e9821d4b6cb86a8563bd3df06601fbff47d2a61be62
-
Filesize
200KB
MD514b52ec6cd16f1b730cb513d10c3da0c
SHA17546c64c479f24bc7af13a9f1916a2da30d19ecb
SHA2568f46a3762f0fcbb677c8648fd4e161308ad3f63782f9d709ecd8456bae214860
SHA51277fb3925e94c83ce3f17d91604c4091622c7e088348c55dee015e46c4dc8b64e1ddb93b05d0d715a8b66518fbf57b592692301312ca3b9b80f83187f1586860d
-
Filesize
213KB
MD586ccb6cd12445f9e9741d51d483a80a5
SHA1bcfe9946c3fd96b1d167ace0e885593db242ef6c
SHA256fc5837a429e357cc966c9516c285dbdc8a4012cde52c28d964714738e0426071
SHA5127d3bbf70d70540490fb0af022bcf7b9bf589f4cef215d8799dc3881e9bed687e52b8fbf91f02e138cf6da299951553762ddf8cf0de759532b279b339d01c17e1
-
Filesize
3.4MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
456KB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
3.4MB
-
Filesize
456KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
3.4MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
456KB
-
Filesize
456KB