Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
15-06-2024 07:38
General
-
Target
Nu.exe
-
Size
171KB
-
MD5
a9c54782e05bac7b7b9b8cea3d913260
-
SHA1
6aa281e9055792938a5ae86939f26c4cdc1f1c66
-
SHA256
35083d29c840025e95d9e6e262ef81e55c510530924ff2500b0c454552cb0a84
-
SHA512
10942c53c5cee4201d7482492e1319012fd49b31a0a532cc29b89db3c4438f6a5227403e8af5d2299327d557261fa68940849f855b9f4e7e84898e978ee62a64
-
SSDEEP
3072:zB+zOYDVSuPywKW99VlwAyNjkFvFldOILivyxRYQCvU5outp:zenVSuK2OYZFuILiURYdvSoSp
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 3 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nu.exe"C:\Users\Admin\AppData\Local\Temp\Nu.exe"1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4824-0-0x0000000000400000-0x00000000004D3000-memory.dmpFilesize
844KB
-
memory/4824-1-0x0000000000400000-0x00000000004D3000-memory.dmpFilesize
844KB
-
memory/4824-2-0x0000000000400000-0x00000000004D3000-memory.dmpFilesize
844KB
-
memory/4824-3-0x0000000000400000-0x00000000004D3000-memory.dmpFilesize
844KB