Analysis
- max time kernel
142s - max time network
104s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
06/06/2024, 20:44
General
- Target 2e55a70b6d6f034d896fdf79ea90dc45c1161a59b40b25eb8d64e750a05c3e75.exe
- Size 1.2MB
- Sample240606-zh94bach42
- SHA256 2e55a70b6d6f034d896fdf79ea90dc45c1161a59b40b25eb8d64e750a05c3e75
Malware Config
Signatures
- Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
- Detect Blackmoon payload 4 IoCs
- UPX dump on OEP (original entry point) 49 IoCs
- Executes dropped EXE 3 IoCs
- UPX packed file 49 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e55a70b6d6f034d896fdf79ea90dc45c1161a59b40b25eb8d64e750a05c3e75.exe"C:\Users\Admin\AppData\Local\Temp\2e55a70b6d6f034d896fdf79ea90dc45c1161a59b40b25eb8d64e750a05c3e75.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\data\UpDate.exeC:\Users\Admin\AppData\Local\Temp\data\UpDate.exe 8.1 %43%3A%5C%55%73%65%72%73%5C%41%64%6D%69%6E%5C%41%70%70%44%61%74%61%5C%4C%6F%63%61%6C%5C%54%65%6D%70%5C%32%65%35%35%61%37%30%62%36%64%36%66%30%33%34%64%38%39%36%66%64%66%37%39%65%61%39%30%64%63%34%35%63%31%31%36%31%61%35%39%62%34%30%62%32%35%65%62%38%64%36%34%65%37%35%30%61%30%35%63%33%65%37%35%2E%65%78%65 ¼Ù http://bubusoft.dbankcloud.com/QQ%E5%8A%A8%E6%80%81%E6%89%B9%E9%87%8F%E8%B5%9E/%E7%A7%92%E8%AF%84%E7%A7%92%E8%B5%9E.txt2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2e55a70b6d6f034d896fdf79ea90dc45c1161a59b40b25eb8d64e750a05c3e75.exeC:\Users\Admin\AppData\Local\Temp\2e55a70b6d6f034d896fdf79ea90dc45c1161a59b40b25eb8d64e750a05c3e75.exe ÃüÁîÆô¶¯3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\data\Bugreport.dllC:\Users\Admin\AppData\Local\Temp\data\Bugreport.dll %42%75%67%72%65%70%6F%72%74 %E7%A7%92%E8%AF%84%E7%A7%92%204⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
2e55a70b6d6f034d896fdf79ea90dc45c1161a59b40b25eb8d64e750a05c3e75.exe
Bugreport.dll
Bugreport.ini
Bugreport_error.ini
UpDate.exe
memory/1020-15-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1020-47-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1020-2-0x00000000025F0000-0x0000000002662000-memory.dmp
memory/1020-31-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1020-49-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1020-51-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1020-50-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1020-58-0x0000000000400000-0x000000000075A000-memory.dmp
memory/1020-57-0x00000000025F0000-0x0000000002662000-memory.dmp
memory/1020-4-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1020-9-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1020-44-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1020-41-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1020-39-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1020-35-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1020-33-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1020-29-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1020-27-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1020-25-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1020-23-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1020-17-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1020-0-0x0000000000400000-0x000000000075A000-memory.dmp
memory/1020-1-0x00000000025F0000-0x0000000002662000-memory.dmp
memory/1020-13-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1020-48-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1020-3-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1020-21-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1020-19-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1020-11-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1020-7-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1020-5-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1964-75-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1964-76-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1964-64-0x0000000002640000-0x00000000026B2000-memory.dmp
memory/1964-80-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1964-82-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1964-110-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1964-109-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1964-62-0x0000000000400000-0x000000000075A000-memory.dmp
memory/1964-63-0x0000000002640000-0x00000000026B2000-memory.dmp
memory/1964-72-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1964-78-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1964-70-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1964-69-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1964-67-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1964-65-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1964-151-0x0000000000400000-0x000000000075A000-memory.dmp
memory/1964-157-0x0000000002640000-0x00000000026B2000-memory.dmp