Analysis
-
max time kernel
141s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/08/2024, 08:33
General
-
Target
2024-08-19_9347995eb11be1b0d8fb4a5e847de7ab_xiaoba.exe
-
Size
1.9MB
-
MD5
9347995eb11be1b0d8fb4a5e847de7ab
-
SHA1
a5a89eb60dcdb0105f341b2fcee35d9b1d9371b2
-
SHA256
f7e5967eef70eaaec0732c9d9bcf98aadba0e52432c28fe934ca61042298b7a2
-
SHA512
10af6a214b778cd5efec12c10b6a4a3b10ea3faa3232ccb3d6decbbaedf3bf2442e323d030a03f0432f6fd69415a4ece35f6d7213d4933fab17893bd71b3f7ac
-
SSDEEP
24576:kAy0knII1bE0fvik0JsUxstaftv4AdfFj8i0gL9OEssHXyVHGIJrMGmKiprFMXrp:5b4AhUgL0sKJD1cs
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 37 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Network Service Discovery 1 TTPs 4 IoCs
Attempt to gather information on host's network.
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-19_9347995eb11be1b0d8fb4a5e847de7ab_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-19_9347995eb11be1b0d8fb4a5e847de7ab_xiaoba.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks /create /tn "ÆïÊ¿´úÁ·ÁìV¶ÁÄÚ´æ×Ó³ÌÐò" /tr C:\Users\Admin\AppData\Local\Temp\2024-08-19_9347995eb11be1b0d8fb4a5e847de7ab_xiaoba.exe /sc ONLOGON /delay 0000:02 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "ÆïÊ¿´úÁ·ÁìV¶ÁÄÚ´æ×Ó³ÌÐò" /tr C:\Users\Admin\AppData\Local\Temp\2024-08-19_9347995eb11be1b0d8fb4a5e847de7ab_xiaoba.exe /sc ONLOGON /delay 0000:02 /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe/c arp -a2⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ARP.EXEarp -a3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe/c arp -a2⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ARP.EXEarp -a3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
152KB
-
Filesize
2.2MB
-
Filesize
4KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB