Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

e46d7c0ef3...1b.exe

windows7-x64

10

e46d7c0ef3...1b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 18:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe

  • Size

    89KB

  • MD5

    bf9fca4cd65d1d0e6e242733650f7783

  • SHA1

    7d969fa24c271f7104986eb5e8463c3d803040cd

  • SHA256

    e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b

  • SHA512

    079577c0807ef3af8a014a510d3c42dc5a4809ab461fc0a0950c167539a7a3084291f084d48ec85f1255a0e256c85b62c9f9ab98ae8da0c218b448b63fa43b8a

  • SSDEEP

    1536:5+4hkM3Yz8wMZhUD2XsjEQWOSkE+Ct6WKBex3GWU5FkWp+AmQwKGSZhCQbIo/tSI:dq6OLM3QasY5Ft71fqWWp+efG4hCQrR

Score
10/10
blackmoonbankertrojanupx

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon
  • Detect Blackmoon payload 4 IoCs
  • UPX dump on OEP (original entry point) 6 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe
    "C:\Users\Admin\AppData\Local\Temp\e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4020
    • C:\Users\Admin\AppData\Local\Temp\Syslemjtjeh.exe
      "C:\Users\Admin\AppData\Local\Temp\Syslemjtjeh.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3836
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4200,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:8
    1⤵
      PID:2996

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Syslemjtjeh.exe
      Filesize

      89KB

      MD5

      25099b8fa2355422e12b9d33727381e6

      SHA1

      8405fc6e9eb5c56eee978949d7f9ccdb003a4f3d

      SHA256

      0fe06cba6a348c473a4ed0348ec5c79bd6515b6b3acc2787bf97ff232dad60a9

      SHA512

      9e02c996ec1c3425dd8e4514e193f93cf564dbd9ef4dda72d9ea06e4dd973aa19e559feaee7ce31a709e2fb986f6627ee5cca5df08a9e41265337436edcb248b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\lpath.ini
      Filesize

      102B

      MD5

      9e79a9808e21509cbdcf8e1f1e447b49

      SHA1

      eae0d6ac51aa68f2d119b381c3f9ad57d4d74b1d

      SHA256

      f88807a04d048d0bb611268b476c9a0c8814d4d016faf5e7827d1e857846cc87

      SHA512

      3d493b05a00f0b6aec62284e00dd087e6338c738e0e9c426f616ef8b3c903eb914f2eb91a389fcd12469bec4dc7ffc6ad7b365c0c37d388842fa856254f3d923

      Download Submit

    • memory/3836-18-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4020-0-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4020-2-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4020-4-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4020-16-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

      Download