Analysis
-
max time kernel
119s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21-08-2024 09:21
General
-
Target
ad02957f57989db23295419fe6b9c770N.exe
-
Size
88KB
-
MD5
ad02957f57989db23295419fe6b9c770
-
SHA1
feefc096fa3412dc50efeb837ad1cab250c874d4
-
SHA256
aecf8e34f39dfd4ddfeba4380f3a1c11d765b8151d777e8faf8e4931f2a02937
-
SHA512
63d2d140f8ce0abf61828ee2e91981cfd5d171888284f298a4edb07c7378c04b0105bfaa83c0c97c903ff43cbe032de212b0049f904f69ab975362c8ecc12ebf
-
SSDEEP
1536:/s2OpUqBA6pkuTHQ0cIrf+7LYsF03RYSYhM9l8yDI15XygDSC:/ImRWTTpc627LXFm6+9l8nygDSC
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad02957f57989db23295419fe6b9c770N.exe"C:\Users\Admin\AppData\Local\Temp\ad02957f57989db23295419fe6b9c770N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Systemldvtk.exe"C:\Users\Admin\AppData\Local\Temp\Systemldvtk.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5cb4be331f43c2d58933dbff4d86ee846
SHA1bf7080e875e46ae4d299066fc35809794791df9c
SHA256f6daf9308b6739a71edfd0f0f56a521b280b6fe0d5bfdd7ebb133d9150b7c32b
SHA51255bc557dbaff29708b48723b7c94318ac7c22728aa1ac1fbaba3d69b0346d553508f3fa40ab88d00ab3e1454b0c8fff0d20133d1b2fbce4c9f11ee27eec3816a
-
Filesize
71B
MD59beeb3846d6b5b216a8db105ee3a0dc4
SHA1fa58206bbe79482a7e7a78ef49d52884e04a8ba9
SHA2561ea6f1c273563d8e34f8646dcf9e43b9b4af77f12c5e25e50a476eaec1ccd3e3
SHA5129ba0310f4314517dfd57ab29e925b724ffb2ebed59d9d9e8a15d7cc5cf00e08490f04317a85ec3a2b6390eb9e29c535fde6640dfd1afa7f9cbcf0a5cd18f7426
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
416KB