Analysis
-
max time kernel
132s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
11/06/2024, 04:42
General
-
Target
2024-06-11_3bab718d577a60b66fcf421437a24186_mafia.exe
-
Size
1.3MB
-
MD5
3bab718d577a60b66fcf421437a24186
-
SHA1
1ade733cd947eda964a4bf6e10f398713bc321cf
-
SHA256
b807c789883ffd0a0b220b4bf214423f33c22d558ce2275b617cdbc8d7af4e58
-
SHA512
dacfe01e7c67dcc6244b0600fafac5bbc9dca7ab5b0491d9735637214f0163941e57d39da2eae8106e170d934882f0c01a32ec8745605c2eeafbfc3e9f93d03d
-
SSDEEP
24576:R1UGLrmwPVsjEkazzCm8pslRI4/iK6LfGJErGCkfp0sUPYud9mj1uRyRsGyz:Ru2jkaqm8pwOOiMeGPfp0sUPYu7UQq
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 5 IoCs
-
UPX dump on OEP (original entry point) 7 IoCs
-
Drops startup file 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_3bab718d577a60b66fcf421437a24186_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_3bab718d577a60b66fcf421437a24186_mafia.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.0MB
-
Filesize
80KB
-
Filesize
96KB
-
Filesize
1.4MB
-
Filesize
356KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
356KB