Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
29/08/2024, 12:22
General
-
Target
64100a940c045dbcbae134154d17c670N.exe
-
Size
132KB
-
MD5
64100a940c045dbcbae134154d17c670
-
SHA1
dfd946b5b88ae5c767149e8fcc20712cdf779a59
-
SHA256
dfad95858bb5b3bef2649ff094d5f60fcaa51a9c5a8207a8db2bf036eb90b833
-
SHA512
de7e7bb81c03e889a763e3595d9d3e72702c42018fd76c8e82928cfbb8b72e92e7ea5d21e1170535ac9c71bed3581dcd3afd1efe42e67b370439cef9af27bc97
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp9gFb8kSv3v1Jgs7hMw8s5bBZfn:n3C9BRo7tvnJ9oLSvv1FhMVIfn
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 22 IoCs
-
Executes dropped EXE 64 IoCs
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\64100a940c045dbcbae134154d17c670N.exe"C:\Users\Admin\AppData\Local\Temp\64100a940c045dbcbae134154d17c670N.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\llrlrrx.exec:\llrlrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frfllrr.exec:\frfllrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7ttbbb.exec:\7ttbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9jvpp.exec:\9jvpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvjvj.exec:\dvjvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7rfxffx.exec:\7rfxffx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htbbbb.exec:\htbbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdpvd.exec:\pdpvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9lrxlrx.exec:\9lrxlrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlfxrxx.exec:\rlfxrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhnbb.exec:\hbhnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdvdd.exec:\pdvdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpdjj.exec:\dpdjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frxffll.exec:\frxffll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frfflrr.exec:\frfflrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htbhnt.exec:\htbhnt.exe17⤵
- Executes dropped EXE
-
\??\c:\9httbt.exec:\9httbt.exe18⤵
- Executes dropped EXE
-
\??\c:\dvdjv.exec:\dvdjv.exe19⤵
- Executes dropped EXE
-
\??\c:\rlrrffx.exec:\rlrrffx.exe20⤵
- Executes dropped EXE
-
\??\c:\bnbtnh.exec:\bnbtnh.exe21⤵
- Executes dropped EXE
-
\??\c:\hnttbb.exec:\hnttbb.exe22⤵
- Executes dropped EXE
-
\??\c:\dpppp.exec:\dpppp.exe23⤵
- Executes dropped EXE
-
\??\c:\jvdjp.exec:\jvdjp.exe24⤵
- Executes dropped EXE
-
\??\c:\lxlffrr.exec:\lxlffrr.exe25⤵
- Executes dropped EXE
-
\??\c:\3rfffxx.exec:\3rfffxx.exe26⤵
- Executes dropped EXE
-
\??\c:\httbhb.exec:\httbhb.exe27⤵
- Executes dropped EXE
-
\??\c:\5tbbnb.exec:\5tbbnb.exe28⤵
- Executes dropped EXE
-
\??\c:\pjpvd.exec:\pjpvd.exe29⤵
- Executes dropped EXE
-
\??\c:\7fllfxf.exec:\7fllfxf.exe30⤵
- Executes dropped EXE
-
\??\c:\3hnhhb.exec:\3hnhhb.exe31⤵
- Executes dropped EXE
-
\??\c:\nttnnn.exec:\nttnnn.exe32⤵
- Executes dropped EXE
-
\??\c:\jvdpj.exec:\jvdpj.exe33⤵
- Executes dropped EXE
-
\??\c:\vjjjd.exec:\vjjjd.exe34⤵
- Executes dropped EXE
-
\??\c:\xrlrrfl.exec:\xrlrrfl.exe35⤵
- Executes dropped EXE
-
\??\c:\9llrxlr.exec:\9llrxlr.exe36⤵
- Executes dropped EXE
-
\??\c:\bhbtbb.exec:\bhbtbb.exe37⤵
- Executes dropped EXE
-
\??\c:\7thttb.exec:\7thttb.exe38⤵
- Executes dropped EXE
-
\??\c:\htthbt.exec:\htthbt.exe39⤵
- Executes dropped EXE
-
\??\c:\pjddv.exec:\pjddv.exe40⤵
- Executes dropped EXE
-
\??\c:\1vdpp.exec:\1vdpp.exe41⤵
- Executes dropped EXE
-
\??\c:\7xllxrr.exec:\7xllxrr.exe42⤵
- Executes dropped EXE
-
\??\c:\rrlxxlr.exec:\rrlxxlr.exe43⤵
- Executes dropped EXE
-
\??\c:\bhbbhb.exec:\bhbbhb.exe44⤵
- Executes dropped EXE
-
\??\c:\bnhbbb.exec:\bnhbbb.exe45⤵
- Executes dropped EXE
-
\??\c:\pjjvj.exec:\pjjvj.exe46⤵
- Executes dropped EXE
-
\??\c:\9rfxrxr.exec:\9rfxrxr.exe47⤵
- Executes dropped EXE
-
\??\c:\xrxxxrx.exec:\xrxxxrx.exe48⤵
- Executes dropped EXE
-
\??\c:\7lxxfll.exec:\7lxxfll.exe49⤵
- Executes dropped EXE
-
\??\c:\hthbnh.exec:\hthbnh.exe50⤵
- Executes dropped EXE
-
\??\c:\vdjdj.exec:\vdjdj.exe51⤵
- Executes dropped EXE
-
\??\c:\pdvjv.exec:\pdvjv.exe52⤵
- Executes dropped EXE
-
\??\c:\9vvpp.exec:\9vvpp.exe53⤵
- Executes dropped EXE
-
\??\c:\9lrfxll.exec:\9lrfxll.exe54⤵
- Executes dropped EXE
-
\??\c:\btbbnn.exec:\btbbnn.exe55⤵
- Executes dropped EXE
-
\??\c:\nbbnht.exec:\nbbnht.exe56⤵
- Executes dropped EXE
-
\??\c:\dpvvp.exec:\dpvvp.exe57⤵
- Executes dropped EXE
-
\??\c:\vjdpj.exec:\vjdpj.exe58⤵
- Executes dropped EXE
-
\??\c:\frrfxrx.exec:\frrfxrx.exe59⤵
- Executes dropped EXE
-
\??\c:\xrrflrr.exec:\xrrflrr.exe60⤵
- Executes dropped EXE
-
\??\c:\9btnhb.exec:\9btnhb.exe61⤵
- Executes dropped EXE
-
\??\c:\nbhbbb.exec:\nbhbbb.exe62⤵
- Executes dropped EXE
-
\??\c:\jpppv.exec:\jpppv.exe63⤵
- Executes dropped EXE
-
\??\c:\pdvpd.exec:\pdvpd.exe64⤵
- Executes dropped EXE
-
\??\c:\1rxrllx.exec:\1rxrllx.exe65⤵
- Executes dropped EXE
-
\??\c:\xffxffr.exec:\xffxffr.exe66⤵
-
\??\c:\btnhtn.exec:\btnhtn.exe67⤵
-
\??\c:\nbhhth.exec:\nbhhth.exe68⤵
-
\??\c:\9pddd.exec:\9pddd.exe69⤵
-
\??\c:\dvddj.exec:\dvddj.exe70⤵
-
\??\c:\9ffrlxx.exec:\9ffrlxx.exe71⤵
-
\??\c:\3frxfff.exec:\3frxfff.exe72⤵
-
\??\c:\bnbhnn.exec:\bnbhnn.exe73⤵
-
\??\c:\jvppj.exec:\jvppj.exe74⤵
-
\??\c:\9llfrll.exec:\9llfrll.exe75⤵
-
\??\c:\3hhtnh.exec:\3hhtnh.exe76⤵
-
\??\c:\hbhhnt.exec:\hbhhnt.exe77⤵
-
\??\c:\9pddv.exec:\9pddv.exe78⤵
-
\??\c:\jvppv.exec:\jvppv.exe79⤵
-
\??\c:\5rxllff.exec:\5rxllff.exe80⤵
-
\??\c:\9xrrrlr.exec:\9xrrrlr.exe81⤵
-
\??\c:\thhbbt.exec:\thhbbt.exe82⤵
-
\??\c:\hbttbb.exec:\hbttbb.exe83⤵
-
\??\c:\3nntnh.exec:\3nntnh.exe84⤵
-
\??\c:\jvppv.exec:\jvppv.exe85⤵
-
\??\c:\7rrfxrr.exec:\7rrfxrr.exe86⤵
-
\??\c:\9rxrlll.exec:\9rxrlll.exe87⤵
-
\??\c:\bttttn.exec:\bttttn.exe88⤵
-
\??\c:\bnnnhh.exec:\bnnnhh.exe89⤵
-
\??\c:\pdpjv.exec:\pdpjv.exe90⤵
-
\??\c:\vvdjp.exec:\vvdjp.exe91⤵
-
\??\c:\rflxlfr.exec:\rflxlfr.exe92⤵
-
\??\c:\rfxrxff.exec:\rfxrxff.exe93⤵
-
\??\c:\hbbbbb.exec:\hbbbbb.exe94⤵
-
\??\c:\hthhhb.exec:\hthhhb.exe95⤵
-
\??\c:\pdpjd.exec:\pdpjd.exe96⤵
-
\??\c:\3vpdd.exec:\3vpdd.exe97⤵
-
\??\c:\lrrlxrr.exec:\lrrlxrr.exe98⤵
-
\??\c:\xfrfxrr.exec:\xfrfxrr.exe99⤵
-
\??\c:\bnnnnn.exec:\bnnnnn.exe100⤵
-
\??\c:\7vjpp.exec:\7vjpp.exe101⤵
-
\??\c:\5pdvp.exec:\5pdvp.exe102⤵
-
\??\c:\pdjvp.exec:\pdjvp.exe103⤵
-
\??\c:\9xfffff.exec:\9xfffff.exe104⤵
-
\??\c:\7rfffrr.exec:\7rfffrr.exe105⤵
-
\??\c:\thnttt.exec:\thnttt.exe106⤵
-
\??\c:\3btnhb.exec:\3btnhb.exe107⤵
-
\??\c:\jdppj.exec:\jdppj.exe108⤵
-
\??\c:\jvdvd.exec:\jvdvd.exe109⤵
-
\??\c:\7xrffxx.exec:\7xrffxx.exe110⤵
-
\??\c:\5frrxxx.exec:\5frrxxx.exe111⤵
-
\??\c:\ntttnn.exec:\ntttnn.exe112⤵
-
\??\c:\thhhbt.exec:\thhhbt.exe113⤵
-
\??\c:\dpvvd.exec:\dpvvd.exe114⤵
-
\??\c:\3vdvp.exec:\3vdvp.exe115⤵
-
\??\c:\frrrxxf.exec:\frrrxxf.exe116⤵
-
\??\c:\xxxxllr.exec:\xxxxllr.exe117⤵
-
\??\c:\tnhhbb.exec:\tnhhbb.exe118⤵
- System Location Discovery: System Language Discovery
-
\??\c:\3nthbb.exec:\3nthbb.exe119⤵
-
\??\c:\vjppd.exec:\vjppd.exe120⤵
-
\??\c:\pdjdd.exec:\pdjdd.exe121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-