Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    132s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/08/2024, 07:18

General

  • Target

    a0860ec4a71abefd32752ec1dd6d112d115b99d194626961315a112c1d86c72f.exe

  • Size

    8.4MB

  • MD5

    b706e254cb166e03b8a70227c69b92ee

  • SHA1

    e59c8de0bb74cf21f588ba836c9c3e944056242e

  • SHA256

    a0860ec4a71abefd32752ec1dd6d112d115b99d194626961315a112c1d86c72f

  • SHA512

    619b5a3f3e470f68277dc7abd09078c4bf6be2e82925dd38660510062ed7e3ce5d733624b04f8f51db5e5f34adb2080ce4bb93d51778bb39b571dd5a0403b80a

  • SSDEEP

    196608:2xGVoJZNm1TqxtRdac6XRUGb+rpTsmjkxCA3/TBYvjz3f4Jzx7:sGKdmBqxNSmYsCmAxL3lYff4

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 3 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0860ec4a71abefd32752ec1dd6d112d115b99d194626961315a112c1d86c72f.exe
    "C:\Users\Admin\AppData\Local\Temp\a0860ec4a71abefd32752ec1dd6d112d115b99d194626961315a112c1d86c72f.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1056-9-0x0000000000C07000-0x0000000000FA5000-memory.dmp

    Filesize

    3.6MB

  • memory/1056-6-0x0000000003700000-0x0000000003701000-memory.dmp

    Filesize

    4KB

  • memory/1056-5-0x00000000036F0000-0x00000000036F1000-memory.dmp

    Filesize

    4KB

  • memory/1056-4-0x00000000036E0000-0x00000000036E1000-memory.dmp

    Filesize

    4KB

  • memory/1056-3-0x00000000036D0000-0x00000000036D1000-memory.dmp

    Filesize

    4KB

  • memory/1056-2-0x00000000036A0000-0x00000000036A1000-memory.dmp

    Filesize

    4KB

  • memory/1056-1-0x0000000003690000-0x0000000003691000-memory.dmp

    Filesize

    4KB

  • memory/1056-0-0x0000000001F60000-0x0000000001F61000-memory.dmp

    Filesize

    4KB

  • memory/1056-11-0x0000000000400000-0x000000000180F000-memory.dmp

    Filesize

    20.1MB

  • memory/1056-12-0x0000000000400000-0x000000000180F000-memory.dmp

    Filesize

    20.1MB

  • memory/1056-13-0x0000000000400000-0x000000000180F000-memory.dmp

    Filesize

    20.1MB