Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
18/08/2024, 19:41
General
-
Target
023256610d01ff1b60420fdbeae2d0e0N.exe
-
Size
501KB
-
MD5
023256610d01ff1b60420fdbeae2d0e0
-
SHA1
eb7fe68e4028a49b2e9eb8634674f224c7020eb4
-
SHA256
0f02f1766438e8e4b6a92d669ac2d4dc0a6d9b448a4c332258e5b9c02da04db5
-
SHA512
f2296a110ab164a79d921f0abc9abc4d12a5d3f44b7406ba7089b78f6af0abc2f3a45189dc4af311ac8ec481834be1ec87efbfb8999caa4d024ee8a579df0bcc
-
SSDEEP
6144:5cHpJfHElepVuWwP5YcQfg8J+ojiJ+URr:5ifk0GPacQfxjiJ+URr
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\023256610d01ff1b60420fdbeae2d0e0N.exe"C:\Users\Admin\AppData\Local\Temp\023256610d01ff1b60420fdbeae2d0e0N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Systembseyz.exe"C:\Users\Admin\AppData\Local\Temp\Systembseyz.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
501KB
MD5fff3660e6b30463259beb6fdfdba962a
SHA10b0dcb51223e61c30086df11570b2988c43ed7d7
SHA256798998d4d03d5718df5f0531c3ce7527e3dc49a06ca81ecc472841b87a128616
SHA512fd7af0b750ffe7a34ad42775e92c16e7ba6a982b8100e57b03959a55742f9075259280b0c48b91f6aaa16fd3985a287f3e49684a4e4d5b99e563c3683ed97b03
-
Filesize
71B
MD55b48905cfdff2ae98b108c2ee61c32c1
SHA18e37aa10ba3bd806e9a4d9640e2c2442eca25709
SHA256df50b2262e02342b221edfc3a7ff437b8e1f6ab5fe12178af6e88974af24ee8d
SHA512445ef9dc44acbcdc19b3536f9ca67b66681ea6e944e8dd5a6844bbb550ab7b5762d1d7ceea38b2f0fc62de084e347be9d412baf9cda6e9f8df5e9f2bb46b8ac2
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB