Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
07-09-2024 19:59
General
-
Target
afa12aab342eaf22812d241c3d7a8a10N.exe
-
Size
248KB
-
MD5
afa12aab342eaf22812d241c3d7a8a10
-
SHA1
5632f71574ad7487411fe48563f61c4ead050a07
-
SHA256
db6ab0c2fe9acb16fcf217a96619129862e559e0ed5efddeae60506d72683e67
-
SHA512
f5b8fd9aac80b5c6d039284bc26f1a50fe36b542295962649504dc4d9fadd5da65cb4da9c9c2566ca33cddac5453f19a879ffd2989dc674e73337ddeb656dfbf
-
SSDEEP
6144:n3C9BRo/AIX27NHWpU00VIxas1oa3YiFRle:n3C9uD6AUDCa4NYmRQ
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 25 IoCs
-
Executes dropped EXE 64 IoCs
-
UPX packed file 33 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\afa12aab342eaf22812d241c3d7a8a10N.exe"C:\Users\Admin\AppData\Local\Temp\afa12aab342eaf22812d241c3d7a8a10N.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\xffrlfx.exec:\xffrlfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bththt.exec:\bththt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvdjv.exec:\dvdjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3rxrrrx.exec:\3rxrrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhtbnh.exec:\nhtbnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvvvj.exec:\vvvvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxlxrxl.exec:\xxlxrxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbbtt.exec:\nhbbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdddd.exec:\vdddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1lxxflr.exec:\1lxxflr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1nbhnb.exec:\1nbhnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7jvpv.exec:\7jvpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7xrxffr.exec:\7xrxffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btnntb.exec:\btnntb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnthnt.exec:\tnthnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvjdv.exec:\vvjdv.exe17⤵
- Executes dropped EXE
-
\??\c:\5rrxxfr.exec:\5rrxxfr.exe18⤵
- Executes dropped EXE
-
\??\c:\bbbbbb.exec:\bbbbbb.exe19⤵
- Executes dropped EXE
-
\??\c:\hnbtbt.exec:\hnbtbt.exe20⤵
- Executes dropped EXE
-
\??\c:\llfflfr.exec:\llfflfr.exe21⤵
- Executes dropped EXE
-
\??\c:\5xrxflx.exec:\5xrxflx.exe22⤵
- Executes dropped EXE
-
\??\c:\btbnbn.exec:\btbnbn.exe23⤵
- Executes dropped EXE
-
\??\c:\vpdpd.exec:\vpdpd.exe24⤵
- Executes dropped EXE
-
\??\c:\xlfrffl.exec:\xlfrffl.exe25⤵
- Executes dropped EXE
-
\??\c:\fxxfrxr.exec:\fxxfrxr.exe26⤵
- Executes dropped EXE
-
\??\c:\nhntbn.exec:\nhntbn.exe27⤵
- Executes dropped EXE
-
\??\c:\3vjpd.exec:\3vjpd.exe28⤵
- Executes dropped EXE
-
\??\c:\fxxrffx.exec:\fxxrffx.exe29⤵
- Executes dropped EXE
-
\??\c:\hbttnn.exec:\hbttnn.exe30⤵
- Executes dropped EXE
-
\??\c:\5vdpv.exec:\5vdpv.exe31⤵
- Executes dropped EXE
-
\??\c:\lfrxrrx.exec:\lfrxrrx.exe32⤵
- Executes dropped EXE
-
\??\c:\hbtthh.exec:\hbtthh.exe33⤵
- Executes dropped EXE
-
\??\c:\dvpvd.exec:\dvpvd.exe34⤵
- Executes dropped EXE
-
\??\c:\ddvdj.exec:\ddvdj.exe35⤵
- Executes dropped EXE
-
\??\c:\llllrrx.exec:\llllrrx.exe36⤵
- Executes dropped EXE
-
\??\c:\1fxfxxx.exec:\1fxfxxx.exe37⤵
- Executes dropped EXE
-
\??\c:\5htttt.exec:\5htttt.exe38⤵
- Executes dropped EXE
-
\??\c:\vvddd.exec:\vvddd.exe39⤵
- Executes dropped EXE
-
\??\c:\ddvvp.exec:\ddvvp.exe40⤵
- Executes dropped EXE
-
\??\c:\xrffllr.exec:\xrffllr.exe41⤵
- Executes dropped EXE
-
\??\c:\xrlflfl.exec:\xrlflfl.exe42⤵
- Executes dropped EXE
-
\??\c:\3bbbnt.exec:\3bbbnt.exe43⤵
- Executes dropped EXE
-
\??\c:\hhbnbh.exec:\hhbnbh.exe44⤵
- Executes dropped EXE
-
\??\c:\1nbhnt.exec:\1nbhnt.exe45⤵
- Executes dropped EXE
-
\??\c:\jjjvj.exec:\jjjvj.exe46⤵
- Executes dropped EXE
-
\??\c:\5vppd.exec:\5vppd.exe47⤵
- Executes dropped EXE
-
\??\c:\rrlxxxl.exec:\rrlxxxl.exe48⤵
- Executes dropped EXE
-
\??\c:\tnhbhn.exec:\tnhbhn.exe49⤵
- Executes dropped EXE
-
\??\c:\tnttbt.exec:\tnttbt.exe50⤵
- Executes dropped EXE
-
\??\c:\jpppj.exec:\jpppj.exe51⤵
- Executes dropped EXE
-
\??\c:\jdvjd.exec:\jdvjd.exe52⤵
- Executes dropped EXE
-
\??\c:\xrlxrrx.exec:\xrlxrrx.exe53⤵
- Executes dropped EXE
-
\??\c:\llffrrf.exec:\llffrrf.exe54⤵
- Executes dropped EXE
-
\??\c:\btbnhn.exec:\btbnhn.exe55⤵
- Executes dropped EXE
-
\??\c:\pppvj.exec:\pppvj.exe56⤵
- Executes dropped EXE
-
\??\c:\djvdv.exec:\djvdv.exe57⤵
- Executes dropped EXE
-
\??\c:\rlxfllx.exec:\rlxfllx.exe58⤵
- Executes dropped EXE
-
\??\c:\rrxfrrf.exec:\rrxfrrf.exe59⤵
- Executes dropped EXE
-
\??\c:\nhtntt.exec:\nhtntt.exe60⤵
- Executes dropped EXE
-
\??\c:\thhhbt.exec:\thhhbt.exe61⤵
- Executes dropped EXE
-
\??\c:\vpdjp.exec:\vpdjp.exe62⤵
- Executes dropped EXE
-
\??\c:\rlfxlxf.exec:\rlfxlxf.exe63⤵
- Executes dropped EXE
-
\??\c:\3llrflx.exec:\3llrflx.exe64⤵
- Executes dropped EXE
-
\??\c:\bbtnbb.exec:\bbtnbb.exe65⤵
- Executes dropped EXE
-
\??\c:\3thbtn.exec:\3thbtn.exe66⤵
-
\??\c:\pjpvv.exec:\pjpvv.exe67⤵
-
\??\c:\vvjvj.exec:\vvjvj.exe68⤵
-
\??\c:\xrffllx.exec:\xrffllx.exe69⤵
-
\??\c:\1rlxlxf.exec:\1rlxlxf.exe70⤵
-
\??\c:\tnbhth.exec:\tnbhth.exe71⤵
-
\??\c:\tnthtt.exec:\tnthtt.exe72⤵
-
\??\c:\dddjp.exec:\dddjp.exe73⤵
-
\??\c:\5djjp.exec:\5djjp.exe74⤵
-
\??\c:\1fxrrlr.exec:\1fxrrlr.exe75⤵
-
\??\c:\rrflxlr.exec:\rrflxlr.exe76⤵
-
\??\c:\tbbttn.exec:\tbbttn.exe77⤵
-
\??\c:\bthbtn.exec:\bthbtn.exe78⤵
-
\??\c:\ppppd.exec:\ppppd.exe79⤵
-
\??\c:\jddpp.exec:\jddpp.exe80⤵
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe81⤵
-
\??\c:\xxxrxlf.exec:\xxxrxlf.exe82⤵
-
\??\c:\nhhthn.exec:\nhhthn.exe83⤵
-
\??\c:\tnbntb.exec:\tnbntb.exe84⤵
-
\??\c:\vpdjp.exec:\vpdjp.exe85⤵
-
\??\c:\vdjvd.exec:\vdjvd.exe86⤵
-
\??\c:\rxfrlrx.exec:\rxfrlrx.exe87⤵
-
\??\c:\htttbb.exec:\htttbb.exe88⤵
-
\??\c:\7nbhnn.exec:\7nbhnn.exe89⤵
-
\??\c:\vpjpj.exec:\vpjpj.exe90⤵
-
\??\c:\9pjvj.exec:\9pjvj.exe91⤵
-
\??\c:\pjdjp.exec:\pjdjp.exe92⤵
-
\??\c:\5fflfrx.exec:\5fflfrx.exe93⤵
-
\??\c:\fxllffl.exec:\fxllffl.exe94⤵
-
\??\c:\tbhbbt.exec:\tbhbbt.exe95⤵
-
\??\c:\vvpvp.exec:\vvpvp.exe96⤵
-
\??\c:\dvpdp.exec:\dvpdp.exe97⤵
-
\??\c:\ffllxxl.exec:\ffllxxl.exe98⤵
-
\??\c:\lfxlrxr.exec:\lfxlrxr.exe99⤵
-
\??\c:\ttbbnb.exec:\ttbbnb.exe100⤵
-
\??\c:\tnnbbb.exec:\tnnbbb.exe101⤵
-
\??\c:\jjvjd.exec:\jjvjd.exe102⤵
-
\??\c:\7pjjp.exec:\7pjjp.exe103⤵
-
\??\c:\lfrxffx.exec:\lfrxffx.exe104⤵
-
\??\c:\xrflrlx.exec:\xrflrlx.exe105⤵
-
\??\c:\1htbnn.exec:\1htbnn.exe106⤵
-
\??\c:\5bnnhb.exec:\5bnnhb.exe107⤵
-
\??\c:\vvdjv.exec:\vvdjv.exe108⤵
-
\??\c:\pvdpv.exec:\pvdpv.exe109⤵
-
\??\c:\7lffrrx.exec:\7lffrrx.exe110⤵
-
\??\c:\7hhbbh.exec:\7hhbbh.exe111⤵
-
\??\c:\7bhhnh.exec:\7bhhnh.exe112⤵
-
\??\c:\3jvvv.exec:\3jvvv.exe113⤵
-
\??\c:\vjpvd.exec:\vjpvd.exe114⤵
-
\??\c:\lxlllrx.exec:\lxlllrx.exe115⤵
-
\??\c:\rfxfxfl.exec:\rfxfxfl.exe116⤵
-
\??\c:\bthnbb.exec:\bthnbb.exe117⤵
-
\??\c:\9bbbbb.exec:\9bbbbb.exe118⤵
-
\??\c:\dpvpv.exec:\dpvpv.exe119⤵
-
\??\c:\dpddp.exec:\dpddp.exe120⤵
- System Location Discovery: System Language Discovery
-
\??\c:\lxfxxfl.exec:\lxfxxfl.exe121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-