Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
25/06/2024, 09:30
General
-
Target
b0ae3cd0ab2497282cc17a2d386775e827510bf6dc257d773d08afdd100c7690.exe
-
Size
13.2MB
-
MD5
b6e081ba084c6b4cc7840554729e9c84
-
SHA1
699f38e2a7503242d1329726fb9133e196d8bec4
-
SHA256
b0ae3cd0ab2497282cc17a2d386775e827510bf6dc257d773d08afdd100c7690
-
SHA512
8a42b7ffd3c75273eff9172a1b149cb6988883948bd71a0f11e53d45c3f5f841cdaf4fffae28cbe761c24214114d1b4924e0bcc28b37ca2c7a5521885d4377fe
-
SSDEEP
196608:W2TEKrPk/nY2L73dUXnEK9KW9J/Rn8ZbEvtmImY0jjhyq0ShCoWJSB:Pz2pX32Xn7kW93CuNr0HysgM
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 1 IoCs
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
VMProtect packed file 9 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0ae3cd0ab2497282cc17a2d386775e827510bf6dc257d773d08afdd100c7690.exe"C:\Users\Admin\AppData\Local\Temp\b0ae3cd0ab2497282cc17a2d386775e827510bf6dc257d773d08afdd100c7690.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
25.2MB
-
Filesize
25.2MB
-
Filesize
17.8MB
-
Filesize
25.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
17.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
552KB
-
Filesize
25.2MB
-
Filesize
25.2MB
-
Filesize
25.2MB
-
Filesize
3.2MB
-
Filesize
25.2MB