Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
06-09-2024 05:34
General
-
Target
d4db9c85fa9495da6140a0db7178e150N.exe
-
Size
92KB
-
MD5
d4db9c85fa9495da6140a0db7178e150
-
SHA1
bae87e6faf5f9dee21d621de4ff0133b3e073f77
-
SHA256
d0d847cc8ffc482f51591448828e86a582c3b534a4fcba641b67b9d28d741ccc
-
SHA512
7f09682399c5637e9f6404ce9360f6e43f3268a3872a4454780f63e4d36b703ff4c2b0818b350ecfefaa5a4d55f881d8ff2e7ad3fb453ee859b5b7331376a544
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIS7/b9EUeWpEC3alBlwtn8BLn9t:ymb3NkkiQ3mdBjFIi/REUZnKlb94xs
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 22 IoCs
-
Executes dropped EXE 64 IoCs
-
UPX packed file 31 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4db9c85fa9495da6140a0db7178e150N.exe"C:\Users\Admin\AppData\Local\Temp\d4db9c85fa9495da6140a0db7178e150N.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnhhnn.exec:\bnhhnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvpvj.exec:\vvpvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnbbnn.exec:\tnbbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjdvv.exec:\vjdvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpjjp.exec:\vpjjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5lxxffl.exec:\5lxxffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhnnnt.exec:\nhnnnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvvdv.exec:\vvvdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1rxrffl.exec:\1rxrffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3llrffl.exec:\3llrffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnhhbh.exec:\tnhhbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1pjpv.exec:\1pjpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddjpv.exec:\ddjpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3rrrxfr.exec:\3rrrxfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnhtbb.exec:\bnhtbb.exe17⤵
- Executes dropped EXE
-
\??\c:\bhhnnt.exec:\bhhnnt.exe18⤵
- Executes dropped EXE
-
\??\c:\dvddv.exec:\dvddv.exe19⤵
- Executes dropped EXE
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe20⤵
- Executes dropped EXE
-
\??\c:\ffxflfl.exec:\ffxflfl.exe21⤵
- Executes dropped EXE
-
\??\c:\btntbh.exec:\btntbh.exe22⤵
- Executes dropped EXE
-
\??\c:\jdvdp.exec:\jdvdp.exe23⤵
- Executes dropped EXE
-
\??\c:\vpjjj.exec:\vpjjj.exe24⤵
- Executes dropped EXE
-
\??\c:\3xllrxl.exec:\3xllrxl.exe25⤵
- Executes dropped EXE
-
\??\c:\bttnth.exec:\bttnth.exe26⤵
- Executes dropped EXE
-
\??\c:\pjjvj.exec:\pjjvj.exe27⤵
- Executes dropped EXE
-
\??\c:\pdvvd.exec:\pdvvd.exe28⤵
- Executes dropped EXE
-
\??\c:\xrflrrx.exec:\xrflrrx.exe29⤵
- Executes dropped EXE
-
\??\c:\llfxffl.exec:\llfxffl.exe30⤵
- Executes dropped EXE
-
\??\c:\nhttht.exec:\nhttht.exe31⤵
- Executes dropped EXE
-
\??\c:\jvdvv.exec:\jvdvv.exe32⤵
-
\??\c:\3pdjp.exec:\3pdjp.exe33⤵
- Executes dropped EXE
-
\??\c:\3bnnnn.exec:\3bnnnn.exe34⤵
- Executes dropped EXE
-
\??\c:\dpjpd.exec:\dpjpd.exe35⤵
- Executes dropped EXE
-
\??\c:\dvjdd.exec:\dvjdd.exe36⤵
- Executes dropped EXE
-
\??\c:\1xfrflx.exec:\1xfrflx.exe37⤵
- Executes dropped EXE
-
\??\c:\rlflxfr.exec:\rlflxfr.exe38⤵
- Executes dropped EXE
-
\??\c:\7bbhnb.exec:\7bbhnb.exe39⤵
- Executes dropped EXE
-
\??\c:\thnhnt.exec:\thnhnt.exe40⤵
- Executes dropped EXE
-
\??\c:\ddpvj.exec:\ddpvj.exe41⤵
- Executes dropped EXE
-
\??\c:\vjvdj.exec:\vjvdj.exe42⤵
- Executes dropped EXE
-
\??\c:\3lrfflr.exec:\3lrfflr.exe43⤵
- Executes dropped EXE
-
\??\c:\rfxrrrf.exec:\rfxrrrf.exe44⤵
- Executes dropped EXE
-
\??\c:\thbnnt.exec:\thbnnt.exe45⤵
- Executes dropped EXE
-
\??\c:\hbnbnn.exec:\hbnbnn.exe46⤵
- Executes dropped EXE
-
\??\c:\dvddp.exec:\dvddp.exe47⤵
- Executes dropped EXE
-
\??\c:\frrfrrl.exec:\frrfrrl.exe48⤵
- Executes dropped EXE
-
\??\c:\7xrxxfl.exec:\7xrxxfl.exe49⤵
- Executes dropped EXE
-
\??\c:\tbhttn.exec:\tbhttn.exe50⤵
- Executes dropped EXE
-
\??\c:\btbbbn.exec:\btbbbn.exe51⤵
- Executes dropped EXE
-
\??\c:\ppdpp.exec:\ppdpp.exe52⤵
- Executes dropped EXE
-
\??\c:\pjjpp.exec:\pjjpp.exe53⤵
- Executes dropped EXE
-
\??\c:\xlxxffl.exec:\xlxxffl.exe54⤵
- Executes dropped EXE
-
\??\c:\fxrxffr.exec:\fxrxffr.exe55⤵
- Executes dropped EXE
-
\??\c:\bnbbtn.exec:\bnbbtn.exe56⤵
- Executes dropped EXE
-
\??\c:\bnbbtt.exec:\bnbbtt.exe57⤵
- Executes dropped EXE
-
\??\c:\pdppp.exec:\pdppp.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\vjjdd.exec:\vjjdd.exe59⤵
- Executes dropped EXE
-
\??\c:\rfllrlr.exec:\rfllrlr.exe60⤵
- Executes dropped EXE
-
\??\c:\llrxffl.exec:\llrxffl.exe61⤵
- Executes dropped EXE
-
\??\c:\thhntb.exec:\thhntb.exe62⤵
- Executes dropped EXE
-
\??\c:\bnbhbn.exec:\bnbhbn.exe63⤵
- Executes dropped EXE
-
\??\c:\vpddd.exec:\vpddd.exe64⤵
- Executes dropped EXE
-
\??\c:\pjdjp.exec:\pjdjp.exe65⤵
- Executes dropped EXE
-
\??\c:\vppvv.exec:\vppvv.exe66⤵
- Executes dropped EXE
-
\??\c:\5fxfflr.exec:\5fxfflr.exe67⤵
-
\??\c:\tnhhbt.exec:\tnhhbt.exe68⤵
-
\??\c:\dvvpd.exec:\dvvpd.exe69⤵
-
\??\c:\jdppj.exec:\jdppj.exe70⤵
-
\??\c:\frfxffl.exec:\frfxffl.exe71⤵
-
\??\c:\frflxlx.exec:\frflxlx.exe72⤵
-
\??\c:\hbbhht.exec:\hbbhht.exe73⤵
-
\??\c:\5tnthh.exec:\5tnthh.exe74⤵
-
\??\c:\pjvdd.exec:\pjvdd.exe75⤵
-
\??\c:\vvpvv.exec:\vvpvv.exe76⤵
-
\??\c:\rrrfrfl.exec:\rrrfrfl.exe77⤵
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe78⤵
-
\??\c:\hbtbhh.exec:\hbtbhh.exe79⤵
-
\??\c:\tbtbnt.exec:\tbtbnt.exe80⤵
-
\??\c:\pdpvd.exec:\pdpvd.exe81⤵
-
\??\c:\vpvjp.exec:\vpvjp.exe82⤵
-
\??\c:\rlffffl.exec:\rlffffl.exe83⤵
-
\??\c:\xxrxllr.exec:\xxrxllr.exe84⤵
-
\??\c:\bttbtt.exec:\bttbtt.exe85⤵
-
\??\c:\nhtbhh.exec:\nhtbhh.exe86⤵
-
\??\c:\dvppj.exec:\dvppj.exe87⤵
-
\??\c:\5vjpv.exec:\5vjpv.exe88⤵
-
\??\c:\djvjp.exec:\djvjp.exe89⤵
-
\??\c:\lfxlfrf.exec:\lfxlfrf.exe90⤵
-
\??\c:\rlffrrx.exec:\rlffrrx.exe91⤵
-
\??\c:\nbnttt.exec:\nbnttt.exe92⤵
-
\??\c:\bthbbt.exec:\bthbbt.exe93⤵
-
\??\c:\bbtbhn.exec:\bbtbhn.exe94⤵
-
\??\c:\jjvvj.exec:\jjvvj.exe95⤵
-
\??\c:\pjddp.exec:\pjddp.exe96⤵
-
\??\c:\llxfllr.exec:\llxfllr.exe97⤵
-
\??\c:\rfrrffl.exec:\rfrrffl.exe98⤵
-
\??\c:\bbhhhb.exec:\bbhhhb.exe99⤵
-
\??\c:\3btnnn.exec:\3btnnn.exe100⤵
-
\??\c:\jdppv.exec:\jdppv.exe101⤵
-
\??\c:\pjdjv.exec:\pjdjv.exe102⤵
-
\??\c:\9dpvv.exec:\9dpvv.exe103⤵
-
\??\c:\7rflxfr.exec:\7rflxfr.exe104⤵
-
\??\c:\rlxfllx.exec:\rlxfllx.exe105⤵
-
\??\c:\5nbntn.exec:\5nbntn.exe106⤵
-
\??\c:\nnnnbb.exec:\nnnnbb.exe107⤵
-
\??\c:\vvjdd.exec:\vvjdd.exe108⤵
-
\??\c:\7pddd.exec:\7pddd.exe109⤵
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe110⤵
-
\??\c:\xrfxffl.exec:\xrfxffl.exe111⤵
-
\??\c:\thbbnt.exec:\thbbnt.exe112⤵
-
\??\c:\1nhhnn.exec:\1nhhnn.exe113⤵
-
\??\c:\9nbbbb.exec:\9nbbbb.exe114⤵
-
\??\c:\vpddj.exec:\vpddj.exe115⤵
-
\??\c:\lllxrff.exec:\lllxrff.exe116⤵
-
\??\c:\rrflrrl.exec:\rrflrrl.exe117⤵
-
\??\c:\rlxxffl.exec:\rlxxffl.exe118⤵
-
\??\c:\nhttbn.exec:\nhttbn.exe119⤵
-
\??\c:\tnbbbb.exec:\tnbbbb.exe120⤵
- System Location Discovery: System Language Discovery
-
\??\c:\pjvpd.exec:\pjvpd.exe121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-