Analysis
-
max time kernel
142s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
06-06-2024 20:44
General
-
Target
2e55a70b6d6f034d896fdf79ea90dc45c1161a59b40b25eb8d64e750a05c3e75.exe
-
Size
1.2MB
-
MD5
16ba079f5e5ee04b207e0ffcf1ba7271
-
SHA1
81a072360800921be0634f0774f79f7477c8b6bc
-
SHA256
2e55a70b6d6f034d896fdf79ea90dc45c1161a59b40b25eb8d64e750a05c3e75
-
SHA512
1abaeda639fc59e9c9638688baad4b38ce98f8bb513ddf1ad3394e29abd9071e1be1dba6081646377d03305dde82c5eca463a00228baefe2ce09045b752cbd4e
-
SSDEEP
24576:oShIpwiu4A9XGhqSv81OuB8FoXWCf8hc+LSjv8k5teLGoqaebhaUG:obpwiu4YXIdkkW8FoGCf8hZWhXaMha
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 4 IoCs
-
UPX dump on OEP (original entry point) 49 IoCs
-
Executes dropped EXE 3 IoCs
-
UPX packed file 49 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e55a70b6d6f034d896fdf79ea90dc45c1161a59b40b25eb8d64e750a05c3e75.exe"C:\Users\Admin\AppData\Local\Temp\2e55a70b6d6f034d896fdf79ea90dc45c1161a59b40b25eb8d64e750a05c3e75.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\data\UpDate.exeC:\Users\Admin\AppData\Local\Temp\data\UpDate.exe 8.1 %43%3A%5C%55%73%65%72%73%5C%41%64%6D%69%6E%5C%41%70%70%44%61%74%61%5C%4C%6F%63%61%6C%5C%54%65%6D%70%5C%32%65%35%35%61%37%30%62%36%64%36%66%30%33%34%64%38%39%36%66%64%66%37%39%65%61%39%30%64%63%34%35%63%31%31%36%31%61%35%39%62%34%30%62%32%35%65%62%38%64%36%34%65%37%35%30%61%30%35%63%33%65%37%35%2E%65%78%65 ¼Ù http://bubusoft.dbankcloud.com/QQ%E5%8A%A8%E6%80%81%E6%89%B9%E9%87%8F%E8%B5%9E/%E7%A7%92%E8%AF%84%E7%A7%92%E8%B5%9E.txt2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2e55a70b6d6f034d896fdf79ea90dc45c1161a59b40b25eb8d64e750a05c3e75.exeC:\Users\Admin\AppData\Local\Temp\2e55a70b6d6f034d896fdf79ea90dc45c1161a59b40b25eb8d64e750a05c3e75.exe ÃüÁîÆô¶¯3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\data\Bugreport.dllC:\Users\Admin\AppData\Local\Temp\data\Bugreport.dll %42%75%67%72%65%70%6F%72%74 %E7%A7%92%E8%AF%84%E7%A7%92%204⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD57ca3cf847ba91069f5f9101a6665568a
SHA187a2d87e6510527f87e0417bd1aa31877c0c5e3e
SHA2566b37dbbaa445387c08e4348adb04e2d94635e621fd5c5cc1bbe561d89688dbb1
SHA5128b9f62c1882eb32b6d5a729055000e9377bafa179b7e587d9e849440651033c14cc301a4487b06ff90ff9d4a0238165b366713e009963a03729d12928a95b8e5
-
Filesize
200KB
MD514b52ec6cd16f1b730cb513d10c3da0c
SHA17546c64c479f24bc7af13a9f1916a2da30d19ecb
SHA2568f46a3762f0fcbb677c8648fd4e161308ad3f63782f9d709ecd8456bae214860
SHA51277fb3925e94c83ce3f17d91604c4091622c7e088348c55dee015e46c4dc8b64e1ddb93b05d0d715a8b66518fbf57b592692301312ca3b9b80f83187f1586860d
-
Filesize
52B
MD57242801a5cb840575ee2a7d9a3ae4002
SHA1cdaee3d5d4561daa1b1c792a686984cbd4c7da86
SHA25628e32e9fa3389401b9fb95a8be8baac14ea770e85d51417db2fa9452a9644257
SHA512688d03f8d2486d26d45063354c75b63fe26df81a904b361754564a1056e31aabac817840742f43b19e847f95f3aaecac765d6406103a875f535e540974e57157
-
Filesize
299B
MD5925c99d298c5b87a71f3afcd1dbfc8b2
SHA1f71fbc0724b1a17f8b4762cfc3f3f8b5f1df7f93
SHA25673b417e1d22dd25d3381ce6f44d547e62a448f33aca9e0f7b2501699af9ce2e6
SHA512a3e38d916fb39db9fb1a9fb850c49820d638790d22764634ea44c25e56d3c02e540d873b43aac42223830bfd0de8f48eaecd0d6e89ad74dd886cd95a9339b70c
-
Filesize
213KB
MD586ccb6cd12445f9e9741d51d483a80a5
SHA1bcfe9946c3fd96b1d167ace0e885593db242ef6c
SHA256fc5837a429e357cc966c9516c285dbdc8a4012cde52c28d964714738e0426071
SHA5127d3bbf70d70540490fb0af022bcf7b9bf589f4cef215d8799dc3881e9bed687e52b8fbf91f02e138cf6da299951553762ddf8cf0de759532b279b339d01c17e1
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
456KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
3.4MB
-
Filesize
456KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
3.4MB
-
Filesize
248KB
-
Filesize
456KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
3.4MB
-
Filesize
456KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
456KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
3.4MB
-
Filesize
456KB