Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-06-2024 07:34

General

  • Target

    2024-06-21_c31ed1c9d387878c21458bdef6d3260c_mafia.exe

  • Size

    1.3MB

  • MD5

    c31ed1c9d387878c21458bdef6d3260c

  • SHA1

    f4b34b042a130701c96409c9a2057c37f195424e

  • SHA256

    c0aabb3c79a97eabff16d4e215e403f80fadee5d63a54dd7433f0f5125bca4ad

  • SHA512

    48419ae59c8b1705656f63886d509fc34081ff44998ffe5336f9b6e76b125c42528b8762cf9d75d09359768f3c1a9c2418478d35fe5c94d8b904e2ae86d5b256

  • SSDEEP

    24576:R1UGLrmwPVsjEkazzCmRpslRI4/iK6LfGJErGCkfp0sUPYud9mj1uRyRsGyz:Ru2jkaqmRpwOOiMeGPfp0sUPYu7UQq

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 5 IoCs
  • UPX dump on OEP (original entry point) 7 IoCs
  • Drops startup file 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-21_c31ed1c9d387878c21458bdef6d3260c_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-21_c31ed1c9d387878c21458bdef6d3260c_mafia.exe"
    1⤵
    • Drops startup file
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5000

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5000-0-0x0000000000ECE000-0x0000000000ECF000-memory.dmp

    Filesize

    4KB

  • memory/5000-4-0x0000000000E80000-0x0000000000FF1000-memory.dmp

    Filesize

    1.4MB

  • memory/5000-3-0x0000000000E80000-0x0000000000FF1000-memory.dmp

    Filesize

    1.4MB

  • memory/5000-2-0x0000000010000000-0x0000000010014000-memory.dmp

    Filesize

    80KB

  • memory/5000-1-0x0000000002E30000-0x0000000002E57000-memory.dmp

    Filesize

    156KB

  • memory/5000-5-0x0000000003250000-0x0000000003359000-memory.dmp

    Filesize

    1.0MB

  • memory/5000-12-0x0000000003670000-0x0000000003688000-memory.dmp

    Filesize

    96KB

  • memory/5000-14-0x0000000000E80000-0x0000000000FF1000-memory.dmp

    Filesize

    1.4MB

  • memory/5000-13-0x0000000003F30000-0x0000000003F89000-memory.dmp

    Filesize

    356KB

  • memory/5000-15-0x0000000000E80000-0x0000000000FF1000-memory.dmp

    Filesize

    1.4MB

  • memory/5000-16-0x0000000000E80000-0x0000000000FF1000-memory.dmp

    Filesize

    1.4MB

  • memory/5000-17-0x0000000003F30000-0x0000000003F89000-memory.dmp

    Filesize

    356KB

  • memory/5000-18-0x0000000003F30000-0x0000000003F89000-memory.dmp

    Filesize

    356KB

  • memory/5000-20-0x0000000003F30000-0x0000000003F89000-memory.dmp

    Filesize

    356KB

  • memory/5000-21-0x0000000003F30000-0x0000000003F89000-memory.dmp

    Filesize

    356KB

  • memory/5000-22-0x0000000003F30000-0x0000000003F89000-memory.dmp

    Filesize

    356KB

  • memory/5000-23-0x0000000003F30000-0x0000000003F89000-memory.dmp

    Filesize

    356KB

  • memory/5000-24-0x0000000003F30000-0x0000000003F89000-memory.dmp

    Filesize

    356KB

  • memory/5000-25-0x0000000003F30000-0x0000000003F89000-memory.dmp

    Filesize

    356KB

  • memory/5000-26-0x0000000003F30000-0x0000000003F89000-memory.dmp

    Filesize

    356KB

  • memory/5000-27-0x0000000003F30000-0x0000000003F89000-memory.dmp

    Filesize

    356KB

  • memory/5000-28-0x0000000003F30000-0x0000000003F89000-memory.dmp

    Filesize

    356KB

  • memory/5000-29-0x0000000003F30000-0x0000000003F89000-memory.dmp

    Filesize

    356KB