blackmoon | 9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344

Analysis

max time kernel
135s
max time network
144s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
05/08/2024, 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
Size

3.5MB
MD5

eed580e4933eb1887391ba9739eb0746
SHA1

92c3e92634320dfec6fa19349c5ee65c65a16394
SHA256

9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344
SHA512

4bf460a2706b6c1be51d79d72b9bfe3e9686964dc9f337587a3850d1274d8eb33a899504e2a2781803dd0c655eafddada9689b6caea1563471d1d55586ec2fca
SSDEEP

49152:NDJ01sN3amEi/yCzfy3p5J3g2TYIAW3JmSqW7GPGokvqC:NDJ01lily55Jz2bnW7+j

Score

10^/10

blackmoon banker discovery spyware stealer trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 20 IoCs

resource	yara_rule
behavioral1/memory/3036-5-0x0000000002250000-0x000000000244E000-memory.dmp	family_blackmoon
behavioral1/memory/3036-22-0x0000000000820000-0x0000000000831000-memory.dmp	family_blackmoon
behavioral1/memory/3036-21-0x0000000002250000-0x000000000244E000-memory.dmp	family_blackmoon
behavioral1/memory/3036-20-0x0000000000820000-0x0000000000831000-memory.dmp	family_blackmoon
behavioral1/memory/3036-19-0x0000000000820000-0x0000000000831000-memory.dmp	family_blackmoon
behavioral1/memory/3036-12-0x0000000010000000-0x000000001000F000-memory.dmp	family_blackmoon
behavioral1/memory/3036-35-0x0000000002250000-0x000000000244E000-memory.dmp	family_blackmoon
behavioral1/memory/3036-41-0x0000000000400000-0x000000000079B000-memory.dmp	family_blackmoon
behavioral1/memory/2652-46-0x0000000002170000-0x000000000236E000-memory.dmp	family_blackmoon
behavioral1/memory/2652-45-0x0000000002170000-0x000000000236E000-memory.dmp	family_blackmoon
behavioral1/memory/2652-81-0x0000000002170000-0x000000000236E000-memory.dmp	family_blackmoon
behavioral1/memory/2652-76-0x00000000007A0000-0x00000000007B1000-memory.dmp	family_blackmoon
behavioral1/memory/2652-66-0x00000000007A0000-0x00000000007B1000-memory.dmp	family_blackmoon
behavioral1/memory/2652-65-0x00000000007A0000-0x00000000007B1000-memory.dmp	family_blackmoon
behavioral1/memory/2652-57-0x0000000002170000-0x000000000236E000-memory.dmp	family_blackmoon
behavioral1/memory/2652-50-0x0000000002170000-0x000000000236E000-memory.dmp	family_blackmoon
behavioral1/memory/2652-85-0x0000000002170000-0x000000000236E000-memory.dmp	family_blackmoon
behavioral1/memory/2652-86-0x0000000000400000-0x000000000079B000-memory.dmp	family_blackmoon
behavioral1/memory/2652-91-0x0000000000400000-0x000000000079B000-memory.dmp	family_blackmoon
behavioral1/memory/2652-93-0x0000000002170000-0x000000000236E000-memory.dmp	family_blackmoon

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0006000000019695-23.dat	acprotect

Loads dropped DLL 2 IoCs

pid	Process
3036	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
2652	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3036-22-0x0000000000820000-0x0000000000831000-memory.dmp	upx
behavioral1/memory/3036-20-0x0000000000820000-0x0000000000831000-memory.dmp	upx
behavioral1/memory/3036-19-0x0000000000820000-0x0000000000831000-memory.dmp	upx
behavioral1/memory/3036-16-0x0000000000820000-0x0000000000831000-memory.dmp	upx
behavioral1/files/0x0006000000019695-23.dat	upx
behavioral1/memory/3036-26-0x00000000747B0000-0x00000000747EC000-memory.dmp	upx
behavioral1/memory/3036-43-0x00000000747B0000-0x00000000747EC000-memory.dmp	upx
behavioral1/memory/2652-82-0x0000000073A60000-0x0000000073A9C000-memory.dmp	upx
behavioral1/memory/2652-76-0x00000000007A0000-0x00000000007B1000-memory.dmp	upx
behavioral1/memory/2652-66-0x00000000007A0000-0x00000000007B1000-memory.dmp	upx
behavioral1/memory/2652-65-0x00000000007A0000-0x00000000007B1000-memory.dmp	upx
behavioral1/memory/2652-62-0x00000000007A0000-0x00000000007B1000-memory.dmp	upx
behavioral1/memory/2652-87-0x0000000073A60000-0x0000000073A9C000-memory.dmp	upx
behavioral1/memory/2652-94-0x0000000073A60000-0x0000000073A9C000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened (read-only)	\??\Y:	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened (read-only)	\??\Z:	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened (read-only)	\??\H:	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened (read-only)	\??\I:	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened (read-only)	\??\J:	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened (read-only)	\??\O:	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened (read-only)	\??\G:	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened (read-only)	\??\M:	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened (read-only)	\??\X:	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened (read-only)	\??\K:	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened (read-only)	\??\L:	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened (read-only)	\??\R:	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened (read-only)	\??\T:	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened (read-only)	\??\P:	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened (read-only)	\??\Q:	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened (read-only)	\??\S:	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened (read-only)	\??\U:	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened (read-only)	\??\A:	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened (read-only)	\??\B:	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened (read-only)	\??\E:	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened (read-only)	\??\N:	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened (read-only)	\??\W:	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msvcp30.ini	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File created	C:\Windows\SysWOW64\msvcp30.dll	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened for modification	C:\Windows\SysWOW64\msvcp30.ini	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened for modification	C:\Windows\SysWOW64\msvcp30.dll	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe

Probable phishing domain 1 TTPs 2 IoCs

Phishing

T1566

description	flow	ioc
HTTP URL	22	https://www.30my.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8ae7a08b7b1863f6
HTTP URL	39	https://www.30my.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8ae7a37cde99650f

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\msvcp30.ico	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened for modification	C:\Windows\msvcp30.ini	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened for modification	C:\Windows\msvcp30.dll	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File opened for modification	C:\Windows\msvcp30.ini	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File created	C:\Windows\msvcp30.ico	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
File created	C:\Windows\msvcp30.dll	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c92000000000200000000001066000000010000200000009a013fe0bfdbe1909b3d8c23e10083bb96ec5f2c7ec17491acc62327ebe6b89d000000000e8000000002000020000000bf41f46cecb8045617eda908c149100b30fbbdf1073f519292ee51610fe70b56200000003e2e0a0589dbb53c05705cf387267736c45e251ed26159f11d8e60356c2bf8d04000000084c024dbea903aed6e6480f43e154e0339ba8ebce31abcefc45d7d78b6f0203fd2bbba1a7e53b01f1f29a2cfa9855eb99573a1901175faf97772f66d4baa7350	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c920000000002000000000010660000000100002000000029abc5e920bb701df3461f8dc8a7fafcbd1d93b3c701878a3be771fb56f6a594000000000e8000000002000020000000590ca7817fa7da60ae118bdae05457ddc2ce38e960e0ae25c866502a8a0d294f900000004615d1ff62d12a72bb3bed030e0d0ff1fe122dc4cd16e4708aa337eb45b35f8fb656cf4729dda1e0ab9640ff4afc3fba27b68576c58d53f1fbc9ad965900b4ce49f6ec023734e00a35a3e41e58c99f4bb78663c562a02a2f755ddafc9bf737e9848e4c61d5c13c4e4651b34c2aa12fe0ca8b9f633ddd569a57a41feca8a7eba090ff71000fa7e4b5d2023ef22be7013c40000000395f899163b66008d88d99220ae9ec112735630075445aeba172d46c889dd4485aae7520ae5fca0ae848ab26f878586ae806bb00e4512065aff595bdf2855cc0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B7B75A31-533A-11EF-A1CF-525C7857EE89} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429031580"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8090b68c47e7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
472	Process not Found

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3036	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
Token: SeDebugPrivilege	3036	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
Token: SeDebugPrivilege	3036	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
Token: SeDebugPrivilege	2652	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
Token: SeDebugPrivilege	2652	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
Token: SeDebugPrivilege	2652	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2824	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3036	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
2652	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
2824	iexplore.exe
2824	iexplore.exe
2588	IEXPLORE.EXE
2588	IEXPLORE.EXE
2588	IEXPLORE.EXE
2588	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2652	3036	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe	30
PID 3036 wrote to memory of 2652	3036	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe	30
PID 3036 wrote to memory of 2652	3036	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe	30
PID 3036 wrote to memory of 2652	3036	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe	30
PID 2652 wrote to memory of 2824	2652	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe	32
PID 2652 wrote to memory of 2824	2652	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe	32
PID 2652 wrote to memory of 2824	2652	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe	32
PID 2652 wrote to memory of 2824	2652	9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe	32
PID 2824 wrote to memory of 2588	2824	iexplore.exe	33
PID 2824 wrote to memory of 2588	2824	iexplore.exe	33
PID 2824 wrote to memory of 2588	2824	iexplore.exe	33
PID 2824 wrote to memory of 2588	2824	iexplore.exe	33

C:\Users\Admin\AppData\Local\Temp\9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
"C:\Users\Admin\AppData\Local\Temp\9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe
  "C:\Users\Admin\AppData\Local\Temp\9dab5d9e5caca6691c053d12ef8cb0b2b935fd990133fcc8141d70dbd6ca9344.exe" Admin
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://www.30my.com/kehuduan
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2824 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f766d0b919fabc99660331c43f0dcde

SHA1
01d5a56efebcffc749a5ece9cce6525bc69164bd

SHA256
36a2fed4eb435422cb1ca1bb2c387b7dd96649503f05945d655d7707798e31fd

SHA512
1e64a010835ba28d4815583511e64dd5ba2e8d60f419a3a31d6b262b391225f2ffc1805be827c202b26232a5b2174dd8e28efbe6a8a65013f4d509f6a9246ad9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f25e4d4e209e4e0754e31117854f2a2e

SHA1
64f15fd545d02314a6aceed73596bb0c3b926df0

SHA256
733eb772b60569d9651d64e9842da6d107d477a7aaf16d39126c12bcabae086f

SHA512
6a768d2debccf40dd2db135ea47469a232adc97ffd0d647c83da716dad453cb026611c9bd004678bceaaf8467fbce32f1ca99d9d57722078327ebe776779c3a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d95395871bee93a615b17ddd779e8c0

SHA1
45455ec39ccc314882ba5e1cf639fd8038f6696c

SHA256
442ccfc99254f636817a2b04a99e2b5e4a65b56f5083095d24808601312fef62

SHA512
c171670abdb235d73ae74475663797a10e43368ccc2e9411d254327b904c4e7b4f9b5252925b3c6e62d61d5d390cdab8b1122937b00eda8fdea0e65f7f89ee4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63ea7ff4684fb060d496ec144310ccb5

SHA1
a176be51555a96895867cbf8af9e754531f3eab7

SHA256
0a204ce7d3c631bcceaf1aa8528c16038c8a85b55b2c43e9ba0b376948472cf7

SHA512
8d9e448c8ac38f0df7cf3f485e815322e5c49be960f2c7653c52f8556de0b117e5bc074201492dfcf01471b4a959a3fa31ec92c92e367349b68222d45e5c2f33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5c5f730e07233d3850ad3fd7cadae66

SHA1
8c6c5ca1e94203a17b6fcbbfc1f6b148060bf605

SHA256
7f456ebb07bd1d27d510050d8d6de8956c56e003d47f94f4018a18cf49de98b0

SHA512
2518b70e8c26e9d29557a831e5b643ca6e062685ac580d168137ec307148d66fbf323acb8a825cf3756d544217cd456f3e3455ec1ba541cf24dcbe83baafa19d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e73876f23d6dae58e76c40f2b85feabe

SHA1
626fcd360ad89b137d2d0da1e180d00326768077

SHA256
15ec23bc211a8c8c44e412765c660e323cdf196f7480aa28fbebec58aa32a52d

SHA512
0e09e229eac19852eb44c7281e8b918eed97d5c6a6e4854c29c75241cc3b329820cafa3501c58a5f61eff8e44911707b9dcfc78c6769cfe2edae39a24853cd15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f21d0eeb80e15210c19f812249ba549

SHA1
7cc09a16730bbcc797b457cf666978639836a400

SHA256
b9d44ce19f6294f449428d06a66da3442e9b9279c5268e2d37b999f920fcd42c

SHA512
d7f8a3c7434807745c8fbdf4088d83191b51ea4a2b869fc710675076aeb5d6b9dd7c85f63462aea51795a658575836a14f1be63781826e6b1c08ffcade6b8192

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e3459da0402319259f74125c6d85134

SHA1
f6716cf95a6cdf729117bf2cf38d2586a1dbc459

SHA256
8881bbd02bb47b98d1f289de44141330b3beb109694f3b4726cd31f463e78e28

SHA512
f35ccc1ab37a002873c92f698a204b8a9e03c13b7751123e24345b4021cef45274ecf74b53c45155aee0891d81bd1ef8bbc6fceac6344f2aaa178dbd48c94a4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05a4a79c4484747ad5b184746c5d097d

SHA1
b356ef0f60ab6c87ace19465c63193f11e381d24

SHA256
c0f59c220f4254e330b7081c15ad63ec0712a5952bd724f887bf5475f53d0f9f

SHA512
63ba9ae7b86ad3df12a667ad3a993b61bceb36e93f5baf01ed48d075b194aa440ca2c508f002eab9c659f31706dd5b0e5e282a3a62808c933da3db47a496fefa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcea16648f4b8bd20a028ebd9fd288f6

SHA1
d36ddf5fd7a3a9c728a25b5652b7392d61a71ec1

SHA256
13c61b1842c53670f627ca2b5ef00a7c0706d49f3eac164ae9aa0f987fc24b62

SHA512
800274573d43945cabbdc1b9de292edc3361b82af1c180b242c3d8ba2817d9e2e5bd0f604e04683f7e9f1c4ab4ecd0e626b37310adeab5025c04f4de7389edfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be50f5a153cf842983af8b1df9e93265

SHA1
d1442e42c789fb4613e5902688231eec8d1b2361

SHA256
67f561bcde309608965151bb5f9d4a3c36fc34d1b3c3863b4c6336de3a70b609

SHA512
e713d1d9afc318cbdf6793ad38eb7115b858c2625a887d1d2b7781ad9c6aa75c62735aabdce549d10b71b05d8dd194483a5bc16b4d988edcfa7aca0c7533b6c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
abae81a89165bb573153927a2acb810c

SHA1
b03c5edb9d6d3fb014ce3aba5f8e84c98f43e735

SHA256
cae3addab6d2485ca54ab681c781f0da4e2eedfbb163e99ddf79d73d8f70cc7b

SHA512
c08ef4f272a183248cd17610232aea5035eba21674e88da63e74013c91154fcc19cdee0acd9eb487edabf051abe143efb76c5a15c13cc951a7747fb6b9d1a66f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f7d6d180e1b88cc57ffb9fc16f911b6

SHA1
8e81acc018823b12ebcfb44f5ac53296ae4cba74

SHA256
6f5cf1159f5cee9400d46de00857652e5106b90feccd7e2a01cf993e7af61071

SHA512
7134615cf0ce99d6938b976e92b649b1b2b9d53601f8e5e924d9ec931de40f394b259b424f714ca4ee8eafe4dc85f5484b0b9ff6c14d9c6a3135790dac937788

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
120fcf8ab20443cd335aaa5e806f1057

SHA1
83ee866c381b34482a20ce00192e8da2e43ecf8e

SHA256
5bfce89cab810996c68d602d5450dcdbcd0e6877c2639025f12dd4e9eaee91f7

SHA512
17f772bbbb0dccb557df5cfcf64e240b066ddd1b113d2a205a5a7fddca7f09123795f0acba4e611ea5f36c474838c665095bac58e8c4f70e94541277691f620d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fc2cfa9f56cb8711b4234c39a6d9b79

SHA1
58ce8e5ddd86232583bc3078b0320d5a79e2371e

SHA256
710ebe4e2ee44d2f9d8f286d7d97cd53d1c2c99d242e62bfce2d729ede5d8f59

SHA512
b37636d924320a856bce60d172a1c85514646b0aa5626667794321bf1cb940007c54f0e54e7374f539100181ad649058e8bca7f7e897ebd089311bd0d2e6c5a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9ed2b65d2b397458ce7cfe5226be03a

SHA1
1cdf7a001a860f6794c10baa08253ec0565addc8

SHA256
1ed8b5583646d9856c8bf27a85f7bd9ffabf85d07a441ba1be28d9fb53665a04

SHA512
d0ee7c8a5179dbac0946d7c03468281f0dbf4c1b09f5c8df02c431b3b264dc1ab913c1829ba0c3fab38a622fb82f54a542aa21734179972983f96574d1874e23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec77234f291c43c8fd32a0b0b4631d05

SHA1
0092097ea6e40674b727d408fce415f342747831

SHA256
d27e75985d240909bccc485d13e179ee205c611ece6fd679fa6e8ca71500bcad

SHA512
d7e4e9cfaba277505ef28fea473a17c8a87dc0c9695243d3765ec58bb0a7439bb79024be9438dfc4ce57e31d7b2399994afdba6bca69df0b3ca9dafa0571506d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2dc338bad0c8fd74673036c2fb31ceaf

SHA1
9845c00e60ee75f3b4a1daa46a8c922d63a776e0

SHA256
ee897526883152cb8e1efa4470ace2c763e296f36c92e67bac91f7ef721686c9

SHA512
d9b6283f51ff5a1bd1d5de8d9d08a7d9892f88f43a1b05538288af10ca2f7a6d446895e480b39e7496f1739862dc0d027425067bc106becc245ba8d79b098bd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a9867912b9b7c74fb98ecd2a9602cd6

SHA1
4821ebcf7e23e2e8b830859d8c7f7b130a1d77d2

SHA256
0583cc5acf63c5845812f84dd5e8ad285da7d016cba5d3a312014c726fe439bf

SHA512
c6ee1735e2630a2999cd3344d260b292219816e853853567b2f84bd6df261c5579b2d1946659cd0db7bb5c1a55f081b37358c676149e3f6dc3c779fb74022f22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab800A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar801C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\Desktop\Ä§Óò·¢²¼Íø.url

Filesize
157B

MD5
96a875c56823110c21c400a7f416db27

SHA1
5963f23e6c884c13395424a234a15e06c16cf0b1

SHA256
9cad7e58594aa68aab1c24142aaf066cd6e56c101f3fe48988dc2dc00169aff2

SHA512
8cda61be494e0b7d322e1eab0205bcea1df76cb8a2be419ebf06f1fe952cd5ccfada9552143e3da9c0f76b34bc1491697d7782186c32f58cb7ca33c04d48554b

Download Submit
C:\Windows\SysWOW64\msvcp30.ini

Filesize
18B

MD5
2cd7883782c594d2e2654f8fe988fcbe

SHA1
042bcb87c29e901d70c0ad0f8fa53e0338c569fc

SHA256
aa98ce751ef6ac5401a9278f30c06e250dbbd5e8c2e2c378b0fdf33a205d7037

SHA512
88413dc63847682207d2b1e6cdfcb3de9cc73da5f900a1948e4aa262da20056bcb2486ee8a7c8a4f9b0aa3fdff6b99061262fbc67aebc99bf0b42e5bfc7db360

Download Submit
C:\Windows\msvcp30.ico

Filesize
264KB

MD5
bdccf3c42497089ae7001328305906ed

SHA1
cf6f28e09d98ebe516b408e6b15f03f5891fdc79

SHA256
5f191e3486c0bafdd237f8b79f6ce0f69d1f8c9f8c948d14ab061db36286b2f2

SHA512
d7876d8d414ca48903393aa523296ffe35bfa3c6b5bfc4ce70adfc93d31efa61a9bfeea571754cde2e205416e57c13df5c45551b5e6aae6eb53b951065ebbf5d

Download Submit
\Windows\SysWOW64\msvcp30.dll

Filesize
93KB

MD5
a6c4f055c797a43def0a92e5a85923a7

SHA1
efaa9c3a065aff6a64066f76e7c77ffcaaf779b2

SHA256
73bd285ac6fba28108cdc0d7311e37c4c4fc3ba7d0069c4370778ac3099e21a9

SHA512
d8120f7f59c212867c78af42f93db64d35f2d6eae7fc09021c0a6d8ca71a14bd2b2a3006027094ee2edcf65634dcdb3ac96da3ac810171fff021bed4c4254957

Download Submit
memory/2652-50-0x0000000002170000-0x000000000236E000-memory.dmp

Filesize
2.0MB

Download
memory/2652-82-0x0000000073A60000-0x0000000073A9C000-memory.dmp

Filesize
240KB

Download
memory/2652-85-0x0000000002170000-0x000000000236E000-memory.dmp

Filesize
2.0MB

Download
memory/2652-87-0x0000000073A60000-0x0000000073A9C000-memory.dmp

Filesize
240KB

Download
memory/2652-86-0x0000000000400000-0x000000000079B000-memory.dmp

Filesize
3.6MB

Download
memory/2652-91-0x0000000000400000-0x000000000079B000-memory.dmp

Filesize
3.6MB

Download
memory/2652-94-0x0000000073A60000-0x0000000073A9C000-memory.dmp

Filesize
240KB

Download
memory/2652-93-0x0000000002170000-0x000000000236E000-memory.dmp

Filesize
2.0MB

Download
memory/2652-57-0x0000000002170000-0x000000000236E000-memory.dmp

Filesize
2.0MB

Download
memory/2652-62-0x00000000007A0000-0x00000000007B1000-memory.dmp

Filesize
68KB

Download
memory/2652-65-0x00000000007A0000-0x00000000007B1000-memory.dmp

Filesize
68KB

Download
memory/2652-66-0x00000000007A0000-0x00000000007B1000-memory.dmp

Filesize
68KB

Download
memory/2652-76-0x00000000007A0000-0x00000000007B1000-memory.dmp

Filesize
68KB

Download
memory/2652-77-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2652-81-0x0000000002170000-0x000000000236E000-memory.dmp

Filesize
2.0MB

Download
memory/2652-46-0x0000000002170000-0x000000000236E000-memory.dmp

Filesize
2.0MB

Download
memory/2652-45-0x0000000002170000-0x000000000236E000-memory.dmp

Filesize
2.0MB

Download
memory/3036-6-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/3036-41-0x0000000000400000-0x000000000079B000-memory.dmp

Filesize
3.6MB

Download
memory/3036-43-0x00000000747B0000-0x00000000747EC000-memory.dmp

Filesize
240KB

Download
memory/3036-35-0x0000000002250000-0x000000000244E000-memory.dmp

Filesize
2.0MB

Download
memory/3036-26-0x00000000747B0000-0x00000000747EC000-memory.dmp

Filesize
240KB

Download
memory/3036-12-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3036-16-0x0000000000820000-0x0000000000831000-memory.dmp

Filesize
68KB

Download
memory/3036-19-0x0000000000820000-0x0000000000831000-memory.dmp

Filesize
68KB

Download
memory/3036-20-0x0000000000820000-0x0000000000831000-memory.dmp

Filesize
68KB

Download
memory/3036-21-0x0000000002250000-0x000000000244E000-memory.dmp

Filesize
2.0MB

Download
memory/3036-22-0x0000000000820000-0x0000000000831000-memory.dmp

Filesize
68KB

Download
memory/3036-5-0x0000000002250000-0x000000000244E000-memory.dmp

Filesize
2.0MB

Download