Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
08/08/2024, 22:36
General
-
Target
722cadddb3e98bf09546a0d412664eff7ca3a64e519f8e7ff9a450b07c76f128.exe
-
Size
72KB
-
MD5
ac37b4c2ad4dbe69dc90bcf1b232555f
-
SHA1
31d12a63e3c759c4a093ea2c0c98dd3a84637a67
-
SHA256
722cadddb3e98bf09546a0d412664eff7ca3a64e519f8e7ff9a450b07c76f128
-
SHA512
bfb13d42cc06dd459610eb106e1cc842576a6597ea9e30818a3c368ab8cf837566c8fd618e3839700f6235c631e88157e81bfcb77e0da5f9cf6819edc9adcc0e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUPqrDZ5RxfVT:ymb3NkkiQ3mdBjF0yUmrfVT
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 23 IoCs
-
Executes dropped EXE 64 IoCs
-
UPX packed file 21 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\722cadddb3e98bf09546a0d412664eff7ca3a64e519f8e7ff9a450b07c76f128.exe"C:\Users\Admin\AppData\Local\Temp\722cadddb3e98bf09546a0d412664eff7ca3a64e519f8e7ff9a450b07c76f128.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\btbbnn.exec:\btbbnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdpvv.exec:\jdpvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9jjjd.exec:\9jjjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9lrrllx.exec:\9lrrllx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7nnhbn.exec:\7nnhbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bthbhh.exec:\bthbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfrxffl.exec:\lfrxffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbtnbb.exec:\bbtnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnttbh.exec:\tnttbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9djjp.exec:\9djjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxxrffx.exec:\fxxrffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7lxflxf.exec:\7lxflxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnhnhh.exec:\hnhnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvjpd.exec:\dvjpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvdjv.exec:\vvdjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rfffxxf.exec:\rfffxxf.exe17⤵
- Executes dropped EXE
-
\??\c:\rflrxff.exec:\rflrxff.exe18⤵
- Executes dropped EXE
-
\??\c:\nhbhbh.exec:\nhbhbh.exe19⤵
- Executes dropped EXE
-
\??\c:\jjvjp.exec:\jjvjp.exe20⤵
- Executes dropped EXE
-
\??\c:\llffrrf.exec:\llffrrf.exe21⤵
- Executes dropped EXE
-
\??\c:\llxlrlr.exec:\llxlrlr.exe22⤵
- Executes dropped EXE
-
\??\c:\bthnth.exec:\bthnth.exe23⤵
- Executes dropped EXE
-
\??\c:\dvpvd.exec:\dvpvd.exe24⤵
- Executes dropped EXE
-
\??\c:\vdjpp.exec:\vdjpp.exe25⤵
- Executes dropped EXE
-
\??\c:\3frrxfr.exec:\3frrxfr.exe26⤵
- Executes dropped EXE
-
\??\c:\hbthtb.exec:\hbthtb.exe27⤵
- Executes dropped EXE
-
\??\c:\nhhhtt.exec:\nhhhtt.exe28⤵
- Executes dropped EXE
-
\??\c:\dddjv.exec:\dddjv.exe29⤵
- Executes dropped EXE
-
\??\c:\vpdvj.exec:\vpdvj.exe30⤵
- Executes dropped EXE
-
\??\c:\xrfflxr.exec:\xrfflxr.exe31⤵
- Executes dropped EXE
-
\??\c:\llfrxfl.exec:\llfrxfl.exe32⤵
- Executes dropped EXE
-
\??\c:\5hbhhn.exec:\5hbhhn.exe33⤵
- Executes dropped EXE
-
\??\c:\bbthtt.exec:\bbthtt.exe34⤵
- Executes dropped EXE
-
\??\c:\nhhnhh.exec:\nhhnhh.exe35⤵
- Executes dropped EXE
-
\??\c:\jjdjd.exec:\jjdjd.exe36⤵
- Executes dropped EXE
-
\??\c:\9vvdj.exec:\9vvdj.exe37⤵
- Executes dropped EXE
-
\??\c:\xxffrxl.exec:\xxffrxl.exe38⤵
- Executes dropped EXE
-
\??\c:\lfffrxl.exec:\lfffrxl.exe39⤵
- Executes dropped EXE
-
\??\c:\rlrflrf.exec:\rlrflrf.exe40⤵
- Executes dropped EXE
-
\??\c:\3hhhtn.exec:\3hhhtn.exe41⤵
- Executes dropped EXE
-
\??\c:\tththn.exec:\tththn.exe42⤵
- Executes dropped EXE
-
\??\c:\ddjpv.exec:\ddjpv.exe43⤵
- Executes dropped EXE
-
\??\c:\jdvvd.exec:\jdvvd.exe44⤵
- Executes dropped EXE
-
\??\c:\lfrflrx.exec:\lfrflrx.exe45⤵
- Executes dropped EXE
-
\??\c:\7rlxxxl.exec:\7rlxxxl.exe46⤵
- Executes dropped EXE
-
\??\c:\bthhtt.exec:\bthhtt.exe47⤵
- Executes dropped EXE
-
\??\c:\hnbtbh.exec:\hnbtbh.exe48⤵
- Executes dropped EXE
-
\??\c:\jvjdv.exec:\jvjdv.exe49⤵
- Executes dropped EXE
-
\??\c:\5lflfll.exec:\5lflfll.exe50⤵
- Executes dropped EXE
-
\??\c:\hhtbnn.exec:\hhtbnn.exe51⤵
- Executes dropped EXE
-
\??\c:\9dpjv.exec:\9dpjv.exe52⤵
- Executes dropped EXE
-
\??\c:\lfxfrxl.exec:\lfxfrxl.exe53⤵
- Executes dropped EXE
-
\??\c:\5rlrfrx.exec:\5rlrfrx.exe54⤵
- Executes dropped EXE
-
\??\c:\5bhntb.exec:\5bhntb.exe55⤵
- Executes dropped EXE
-
\??\c:\hbnnbb.exec:\hbnnbb.exe56⤵
- Executes dropped EXE
-
\??\c:\vdvdd.exec:\vdvdd.exe57⤵
- Executes dropped EXE
-
\??\c:\vpdpv.exec:\vpdpv.exe58⤵
- Executes dropped EXE
-
\??\c:\rrxfllr.exec:\rrxfllr.exe59⤵
- Executes dropped EXE
-
\??\c:\xrxfxlr.exec:\xrxfxlr.exe60⤵
- Executes dropped EXE
-
\??\c:\hbtthh.exec:\hbtthh.exe61⤵
- Executes dropped EXE
-
\??\c:\nnhhnn.exec:\nnhhnn.exe62⤵
- Executes dropped EXE
-
\??\c:\vvvjp.exec:\vvvjp.exe63⤵
- Executes dropped EXE
-
\??\c:\dvddd.exec:\dvddd.exe64⤵
- Executes dropped EXE
-
\??\c:\lfrflrf.exec:\lfrflrf.exe65⤵
- Executes dropped EXE
-
\??\c:\xrflrrx.exec:\xrflrrx.exe66⤵
-
\??\c:\hbbhtb.exec:\hbbhtb.exe67⤵
-
\??\c:\7nbhhb.exec:\7nbhhb.exe68⤵
-
\??\c:\ddvvd.exec:\ddvvd.exe69⤵
-
\??\c:\dppvd.exec:\dppvd.exe70⤵
-
\??\c:\fxrlxrf.exec:\fxrlxrf.exe71⤵
-
\??\c:\ffxfrxr.exec:\ffxfrxr.exe72⤵
-
\??\c:\hhbhnn.exec:\hhbhnn.exe73⤵
-
\??\c:\vpjvv.exec:\vpjvv.exe74⤵
-
\??\c:\7vppv.exec:\7vppv.exe75⤵
-
\??\c:\pjvdd.exec:\pjvdd.exe76⤵
-
\??\c:\lfxxxlx.exec:\lfxxxlx.exe77⤵
-
\??\c:\1fflrlf.exec:\1fflrlf.exe78⤵
-
\??\c:\bbnbhn.exec:\bbnbhn.exe79⤵
-
\??\c:\hbbtnn.exec:\hbbtnn.exe80⤵
-
\??\c:\jdjjd.exec:\jdjjd.exe81⤵
-
\??\c:\ppvdp.exec:\ppvdp.exe82⤵
-
\??\c:\lxrrffl.exec:\lxrrffl.exe83⤵
-
\??\c:\rrlrffl.exec:\rrlrffl.exe84⤵
-
\??\c:\7tnthh.exec:\7tnthh.exe85⤵
-
\??\c:\1httbb.exec:\1httbb.exe86⤵
-
\??\c:\hbnnbh.exec:\hbnnbh.exe87⤵
-
\??\c:\5dvdd.exec:\5dvdd.exe88⤵
-
\??\c:\vjpdd.exec:\vjpdd.exe89⤵
-
\??\c:\rlfrlrx.exec:\rlfrlrx.exe90⤵
-
\??\c:\xrffllr.exec:\xrffllr.exe91⤵
-
\??\c:\nntbhh.exec:\nntbhh.exe92⤵
-
\??\c:\tnbbnn.exec:\tnbbnn.exe93⤵
-
\??\c:\9vjpd.exec:\9vjpd.exe94⤵
-
\??\c:\7dvdv.exec:\7dvdv.exe95⤵
-
\??\c:\1rrrrxf.exec:\1rrrrxf.exe96⤵
-
\??\c:\ffflflf.exec:\ffflflf.exe97⤵
-
\??\c:\7nhhbt.exec:\7nhhbt.exe98⤵
-
\??\c:\bbtbnt.exec:\bbtbnt.exe99⤵
-
\??\c:\nnhhbh.exec:\nnhhbh.exe100⤵
-
\??\c:\5jvvv.exec:\5jvvv.exe101⤵
-
\??\c:\dpvpv.exec:\dpvpv.exe102⤵
-
\??\c:\flxfrrf.exec:\flxfrrf.exe103⤵
-
\??\c:\bbttht.exec:\bbttht.exe104⤵
-
\??\c:\7hbhhh.exec:\7hbhhh.exe105⤵
-
\??\c:\vvjpj.exec:\vvjpj.exe106⤵
-
\??\c:\jdddd.exec:\jdddd.exe107⤵
-
\??\c:\frlrfxx.exec:\frlrfxx.exe108⤵
-
\??\c:\fxffllx.exec:\fxffllx.exe109⤵
-
\??\c:\tnbntt.exec:\tnbntt.exe110⤵
-
\??\c:\btbhnt.exec:\btbhnt.exe111⤵
-
\??\c:\nbtntb.exec:\nbtntb.exe112⤵
-
\??\c:\jjppj.exec:\jjppj.exe113⤵
-
\??\c:\pdvvd.exec:\pdvvd.exe114⤵
-
\??\c:\5fxxxfr.exec:\5fxxxfr.exe115⤵
-
\??\c:\rrfrxrx.exec:\rrfrxrx.exe116⤵
-
\??\c:\bbthnt.exec:\bbthnt.exe117⤵
-
\??\c:\ttbhhb.exec:\ttbhhb.exe118⤵
-
\??\c:\vpdjd.exec:\vpdjd.exe119⤵
-
\??\c:\pjvdd.exec:\pjvdd.exe120⤵
- System Location Discovery: System Language Discovery
-
\??\c:\xrffrrf.exec:\xrffrrf.exe121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-