Overview

overview

10

Static

static

10

57c8953f1c...0N.exe

windows7-x64

10

57c8953f1c...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    17/08/2024, 14:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    57c8953f1c2a0bb52182fda6eb105c90N.exe

  • Size

    437KB

  • MD5

    57c8953f1c2a0bb52182fda6eb105c90

  • SHA1

    6282433b51f8f49526a2eafa85df594148301f74

  • SHA256

    ba5414506b0b347beb9ebef6bcdc6c7a82f2dfe6a718d364be0c27675f50e362

  • SHA512

    5d17044a6159d9e51dd008c7c6704b4f160229267c1009a812907d8329e8efeaab5c590331ef979634eb7b722d4709417e433a800a5f9ec23157298482ef4929

  • SSDEEP

    3072:q0mx45LFnq9qDAuSbAXVkQUQ9oPfz0c0uxNUIqTkHoYCDfxj4/0/yjUuMx8kj:q0m2FqgDAuSbAXKfz0c0sUIJHk40/yWX

Score
10/10
blackmoonbankerdiscoverytrojan

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon
  • Detect Blackmoon payload 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 61 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\57c8953f1c2a0bb52182fda6eb105c90N.exe
    "C:\Users\Admin\AppData\Local\Temp\57c8953f1c2a0bb52182fda6eb105c90N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2848
    • C:\Users\Admin\AppData\Local\Temp\Syslemkgmpu.exe
      "C:\Users\Admin\AppData\Local\Temp\Syslemkgmpu.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2860

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\lpath.ini
    Filesize

    71B

    MD5

    b770767195c15d18fd437838813d7eb7

    SHA1

    456d3773738fef34f069cb6977153a0d8ef25594

    SHA256

    abf1d854a256e83f0263ee82fdabf080c681dc6417b6a8fdb998d58d3953040b

    SHA512

    50f4dd6790f0132e142ae4b576d70a2accc1fafba429a12182fe47544f6bf148316ed69ab22c71badc51548ef1c523aacb0802e5549da3f61397de479770eb95

    Download Submit

  • \Users\Admin\AppData\Local\Temp\Syslemkgmpu.exe
    Filesize

    437KB

    MD5

    6ec34cc4fbc9a1c64a56ccc941136943

    SHA1

    86c982054cd908a493ad0a98a8b5bbb4d18a2233

    SHA256

    797336619087fd838953fdd10cfa40ae054125c12b7b62133a1376a71bb2328b

    SHA512

    613488b861bfc688096d7036d84109c27bb0426aa17e0c2536a2a12bdede5bae16944edfa13eddb8cc1fd7b4129875f425f2d3bf73eb721a56dd32dfd1116ec3

    Download Submit