Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17-08-2024 00:57
General
-
Target
7a8d5dc583ec98d3944ccf35d7fb4848b57e3dcce5317b6df410e19812534e03.exe
-
Size
443KB
-
MD5
b1db800bb3ad5885ce6abdb7a41153c1
-
SHA1
50e0d36c311343fa511956697962a1b13416e777
-
SHA256
7a8d5dc583ec98d3944ccf35d7fb4848b57e3dcce5317b6df410e19812534e03
-
SHA512
a3fd3cfdaed748e102e8d70fff7cf9916cb266917ae655782bc1f17df81ea3001b398b349990b2d06846a5267f1045d4013c8b235318d15409b3296eb43ba02c
-
SSDEEP
6144:GfweR7gpANB0sv2YYuwfDoOPV1x0GwYpkxeRhLTQfoSeV:Y1R7gpAwsuvDNP/xyqkxeTLTQfoSeV
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a8d5dc583ec98d3944ccf35d7fb4848b57e3dcce5317b6df410e19812534e03.exe"C:\Users\Admin\AppData\Local\Temp\7a8d5dc583ec98d3944ccf35d7fb4848b57e3dcce5317b6df410e19812534e03.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Syslemvggec.exe"C:\Users\Admin\AppData\Local\Temp\Syslemvggec.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
443KB
MD5482c55893d68d7cf0681c6cf9c48a34c
SHA1d473bf31cf2bf92aebe49533f7c461595b791a5f
SHA2562790a0fc9c1e455c1e2ebf8bafe95336e3d461dfffbe9e56fdfcf41d80b205ed
SHA512875762ddc5697dfe3e665d7270e13114d0a0daa70c97bf60e3cd636a2e48998b7cf982f52c2b662f9e392852ded8535f50219b9b8f03732d202bea351e9ec95b
-
Filesize
102B
MD5b2e6f1e2834863a4805ef7a5ea8f967d
SHA16f7d30dee5040be26c0c1bdfeb8fe15acdab23dd
SHA256bdf7ec2f4f08b0e5c019bf6c549309e2e3cc0a8808584f73425c25568cf508e8
SHA51242fdb12a4d87d060498a011e58a7baa84e32e72e8319c7ac4b28ded829b221ac8f00dfe7a5312e9dda2265695249aa491d17b81dc33a3020f8cd2d6c2cf47450
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
452KB