Analysis
-
max time kernel
120s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
18/08/2024, 01:34
General
-
Target
1664e44118fc4de20b92e2ef0369aea0N.exe
-
Size
64KB
-
MD5
1664e44118fc4de20b92e2ef0369aea0
-
SHA1
73ce4e425a322f483aca437eb22c9a23cbb6027a
-
SHA256
871d914e10373c9ad2b0c827d66a10621da58ef5ce451396ba026f6d6c011ce2
-
SHA512
6d81f84e505a686d39d26db75307155aa7b54d058108a418324bd148225d45979daf48deeef81833f514b3aadc3707ee4d103d0a7f73c8eb31ffed0092080775
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzkzNh:ymb3NkkiQ3mdBjFIvlph
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 23 IoCs
-
Executes dropped EXE 64 IoCs
-
UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1664e44118fc4de20b92e2ef0369aea0N.exe"C:\Users\Admin\AppData\Local\Temp\1664e44118fc4de20b92e2ef0369aea0N.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\3hnhhn.exec:\3hnhhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdvdj.exec:\jdvdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dddjj.exec:\dddjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xfrfflf.exec:\xfrfflf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hthnbb.exec:\hthnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjppj.exec:\pjppj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffxllxr.exec:\ffxllxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnhhtb.exec:\nnhhtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppvjd.exec:\ppvjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thtnbb.exec:\thtnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thtttt.exec:\thtttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjdjp.exec:\pjdjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7rlrxll.exec:\7rlrxll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlrxflx.exec:\rlrxflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhtbnt.exec:\nhtbnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5vjvd.exec:\5vjvd.exe17⤵
- Executes dropped EXE
-
\??\c:\dvjvj.exec:\dvjvj.exe18⤵
- Executes dropped EXE
-
\??\c:\frfrxfl.exec:\frfrxfl.exe19⤵
- Executes dropped EXE
-
\??\c:\7hbhnn.exec:\7hbhnn.exe20⤵
- Executes dropped EXE
-
\??\c:\jdppp.exec:\jdppp.exe21⤵
- Executes dropped EXE
-
\??\c:\9rxlrrf.exec:\9rxlrrf.exe22⤵
- Executes dropped EXE
-
\??\c:\9fxflfr.exec:\9fxflfr.exe23⤵
- Executes dropped EXE
-
\??\c:\tttbbt.exec:\tttbbt.exe24⤵
- Executes dropped EXE
-
\??\c:\ddpjj.exec:\ddpjj.exe25⤵
- Executes dropped EXE
-
\??\c:\vpdpd.exec:\vpdpd.exe26⤵
- Executes dropped EXE
-
\??\c:\fxlfffr.exec:\fxlfffr.exe27⤵
- Executes dropped EXE
-
\??\c:\hbhntb.exec:\hbhntb.exe28⤵
- Executes dropped EXE
-
\??\c:\dvjvd.exec:\dvjvd.exe29⤵
- Executes dropped EXE
-
\??\c:\pjdjv.exec:\pjdjv.exe30⤵
- Executes dropped EXE
-
\??\c:\rlxlrxl.exec:\rlxlrxl.exe31⤵
- Executes dropped EXE
-
\??\c:\3hhnth.exec:\3hhnth.exe32⤵
- Executes dropped EXE
-
\??\c:\3ddjv.exec:\3ddjv.exe33⤵
- Executes dropped EXE
-
\??\c:\7pjdd.exec:\7pjdd.exe34⤵
- Executes dropped EXE
-
\??\c:\1xxrxff.exec:\1xxrxff.exe35⤵
- Executes dropped EXE
-
\??\c:\1nhtbh.exec:\1nhtbh.exe36⤵
- Executes dropped EXE
-
\??\c:\9vvjd.exec:\9vvjd.exe37⤵
- Executes dropped EXE
-
\??\c:\3xxlxrf.exec:\3xxlxrf.exe38⤵
- Executes dropped EXE
-
\??\c:\htbbnn.exec:\htbbnn.exe39⤵
- Executes dropped EXE
-
\??\c:\9tttnb.exec:\9tttnb.exe40⤵
- Executes dropped EXE
-
\??\c:\5ppvv.exec:\5ppvv.exe41⤵
- Executes dropped EXE
-
\??\c:\9dpjp.exec:\9dpjp.exe42⤵
- Executes dropped EXE
-
\??\c:\frllrxx.exec:\frllrxx.exe43⤵
- Executes dropped EXE
-
\??\c:\nnbhnt.exec:\nnbhnt.exe44⤵
- Executes dropped EXE
-
\??\c:\nnnttb.exec:\nnnttb.exe45⤵
- Executes dropped EXE
-
\??\c:\ddvdj.exec:\ddvdj.exe46⤵
- Executes dropped EXE
-
\??\c:\pvdpp.exec:\pvdpp.exe47⤵
- Executes dropped EXE
-
\??\c:\fxxfllx.exec:\fxxfllx.exe48⤵
- Executes dropped EXE
-
\??\c:\9xrrxxl.exec:\9xrrxxl.exe49⤵
- Executes dropped EXE
-
\??\c:\3hhnth.exec:\3hhnth.exe50⤵
- Executes dropped EXE
-
\??\c:\3nbbnb.exec:\3nbbnb.exe51⤵
- Executes dropped EXE
-
\??\c:\vpvvd.exec:\vpvvd.exe52⤵
- Executes dropped EXE
-
\??\c:\rrrfffx.exec:\rrrfffx.exe53⤵
- Executes dropped EXE
-
\??\c:\rrlflxl.exec:\rrlflxl.exe54⤵
- Executes dropped EXE
-
\??\c:\7tnbhb.exec:\7tnbhb.exe55⤵
- Executes dropped EXE
-
\??\c:\thnnhh.exec:\thnnhh.exe56⤵
- Executes dropped EXE
-
\??\c:\dvvdj.exec:\dvvdj.exe57⤵
- Executes dropped EXE
-
\??\c:\dvjpp.exec:\dvjpp.exe58⤵
- Executes dropped EXE
-
\??\c:\lrfxffr.exec:\lrfxffr.exe59⤵
- Executes dropped EXE
-
\??\c:\xrfrxfr.exec:\xrfrxfr.exe60⤵
- Executes dropped EXE
-
\??\c:\hbbnbn.exec:\hbbnbn.exe61⤵
- Executes dropped EXE
-
\??\c:\djpdv.exec:\djpdv.exe62⤵
- Executes dropped EXE
-
\??\c:\djvpv.exec:\djvpv.exe63⤵
- Executes dropped EXE
-
\??\c:\7fxflrl.exec:\7fxflrl.exe64⤵
- Executes dropped EXE
-
\??\c:\lffrrrx.exec:\lffrrrx.exe65⤵
- Executes dropped EXE
-
\??\c:\thnntb.exec:\thnntb.exe66⤵
-
\??\c:\hbnnnn.exec:\hbnnnn.exe67⤵
-
\??\c:\ppppd.exec:\ppppd.exe68⤵
-
\??\c:\vpdpj.exec:\vpdpj.exe69⤵
-
\??\c:\rrlxlxx.exec:\rrlxlxx.exe70⤵
-
\??\c:\3flxflx.exec:\3flxflx.exe71⤵
-
\??\c:\1bhnbb.exec:\1bhnbb.exe72⤵
-
\??\c:\nhbtbh.exec:\nhbtbh.exe73⤵
-
\??\c:\pjddd.exec:\pjddd.exe74⤵
-
\??\c:\1rxrffr.exec:\1rxrffr.exe75⤵
-
\??\c:\lfxfrxr.exec:\lfxfrxr.exe76⤵
-
\??\c:\1bhnnt.exec:\1bhnnt.exe77⤵
-
\??\c:\hhbhtn.exec:\hhbhtn.exe78⤵
-
\??\c:\dvdjv.exec:\dvdjv.exe79⤵
-
\??\c:\vvvjj.exec:\vvvjj.exe80⤵
-
\??\c:\3flrlrf.exec:\3flrlrf.exe81⤵
-
\??\c:\7bthnt.exec:\7bthnt.exe82⤵
-
\??\c:\tbnbhn.exec:\tbnbhn.exe83⤵
-
\??\c:\pvpdd.exec:\pvpdd.exe84⤵
-
\??\c:\vvpjp.exec:\vvpjp.exe85⤵
-
\??\c:\jjdjv.exec:\jjdjv.exe86⤵
-
\??\c:\fxlxlfr.exec:\fxlxlfr.exe87⤵
-
\??\c:\tnbnbn.exec:\tnbnbn.exe88⤵
-
\??\c:\nnhbnt.exec:\nnhbnt.exe89⤵
-
\??\c:\jjvvv.exec:\jjvvv.exe90⤵
-
\??\c:\jdppv.exec:\jdppv.exe91⤵
-
\??\c:\rlfxlrx.exec:\rlfxlrx.exe92⤵
-
\??\c:\1xrfxlr.exec:\1xrfxlr.exe93⤵
-
\??\c:\3thnhn.exec:\3thnhn.exe94⤵
-
\??\c:\hhbnht.exec:\hhbnht.exe95⤵
-
\??\c:\jvvjv.exec:\jvvjv.exe96⤵
-
\??\c:\xxffrfl.exec:\xxffrfl.exe97⤵
-
\??\c:\lxllrrf.exec:\lxllrrf.exe98⤵
-
\??\c:\xrflxxl.exec:\xrflxxl.exe99⤵
-
\??\c:\tnbtnh.exec:\tnbtnh.exe100⤵
-
\??\c:\3nnhth.exec:\3nnhth.exe101⤵
-
\??\c:\jddjd.exec:\jddjd.exe102⤵
-
\??\c:\xxxxrfr.exec:\xxxxrfr.exe103⤵
-
\??\c:\rlxlxxr.exec:\rlxlxxr.exe104⤵
-
\??\c:\btnthh.exec:\btnthh.exe105⤵
-
\??\c:\9hhbnb.exec:\9hhbnb.exe106⤵
-
\??\c:\5vpvv.exec:\5vpvv.exe107⤵
-
\??\c:\vvvpv.exec:\vvvpv.exe108⤵
-
\??\c:\rlfrxfl.exec:\rlfrxfl.exe109⤵
-
\??\c:\5ffxfll.exec:\5ffxfll.exe110⤵
-
\??\c:\lfllrlx.exec:\lfllrlx.exe111⤵
-
\??\c:\ttnhhn.exec:\ttnhhn.exe112⤵
-
\??\c:\hhttbh.exec:\hhttbh.exe113⤵
-
\??\c:\dvpdp.exec:\dvpdp.exe114⤵
-
\??\c:\9dvdp.exec:\9dvdp.exe115⤵
-
\??\c:\rllrrfr.exec:\rllrrfr.exe116⤵
-
\??\c:\xrlrxlr.exec:\xrlrxlr.exe117⤵
-
\??\c:\bbttnn.exec:\bbttnn.exe118⤵
- System Location Discovery: System Language Discovery
-
\??\c:\bbntnn.exec:\bbntnn.exe119⤵
-
\??\c:\5djdp.exec:\5djdp.exe120⤵
-
\??\c:\ppjvp.exec:\ppjvp.exe121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-