Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15/09/2024, 02:41
General
-
Target
64fcbebb8d1a84215d651f610a4bccd0N.exe
-
Size
58KB
-
MD5
64fcbebb8d1a84215d651f610a4bccd0
-
SHA1
e07a62258b0ba28b0faedf1887a46f477bb759ad
-
SHA256
31bed3e60ee4783cca526d5b5b4670eaf62d8b9eca904856e6952e68003dd1f7
-
SHA512
80523c973180751aff2602d69682276b19b9fa75e8296338fe017b7c51edb5b0e5f8045d7eaab3542167315d515835397ef9c70ca2381d136a23662dbc79c383
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgF0fN:ymb3NkkiQ3mdBjFIgF0fN
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 23 IoCs
-
Executes dropped EXE 64 IoCs
-
UPX packed file 35 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1614334282\zmstage.exeC:\Users\Admin\AppData\Local\Temp\1614334282\zmstage.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\64fcbebb8d1a84215d651f610a4bccd0N.exe"C:\Users\Admin\AppData\Local\Temp\64fcbebb8d1a84215d651f610a4bccd0N.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\ldpjp.exec:\ldpjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frddlfh.exec:\frddlfh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hflpbbr.exec:\hflpbbr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rdnrv.exec:\rdnrv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbdrftt.exec:\tbdrftt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpfldt.exec:\vpfldt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bffnlr.exec:\bffnlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhrhld.exec:\nhrhld.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vxftp.exec:\vxftp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dltnp.exec:\dltnp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpjnjh.exec:\dpjnjh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rdvrf.exec:\rdvrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fhnhtj.exec:\fhnhtj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bptrlpd.exec:\bptrlpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppjxvj.exec:\ppjxvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vbndptr.exec:\vbndptr.exe17⤵
- Executes dropped EXE
-
\??\c:\tnjdjdn.exec:\tnjdjdn.exe18⤵
- Executes dropped EXE
-
\??\c:\tbvfj.exec:\tbvfj.exe19⤵
- Executes dropped EXE
-
\??\c:\jltnhd.exec:\jltnhd.exe20⤵
- Executes dropped EXE
-
\??\c:\ldvtp.exec:\ldvtp.exe21⤵
- Executes dropped EXE
-
\??\c:\bbtrbtj.exec:\bbtrbtj.exe22⤵
- Executes dropped EXE
-
\??\c:\xnbrtjb.exec:\xnbrtjb.exe23⤵
- Executes dropped EXE
-
\??\c:\pvfvj.exec:\pvfvj.exe24⤵
- Executes dropped EXE
-
\??\c:\bndjt.exec:\bndjt.exe25⤵
- Executes dropped EXE
-
\??\c:\dffdlnj.exec:\dffdlnj.exe26⤵
- Executes dropped EXE
-
\??\c:\bbhnf.exec:\bbhnf.exe27⤵
- Executes dropped EXE
-
\??\c:\rdnddl.exec:\rdnddl.exe28⤵
- Executes dropped EXE
-
\??\c:\fbdlxrd.exec:\fbdlxrd.exe29⤵
- Executes dropped EXE
-
\??\c:\nnxxt.exec:\nnxxt.exe30⤵
- Executes dropped EXE
-
\??\c:\vrrxtp.exec:\vrrxtp.exe31⤵
- Executes dropped EXE
-
\??\c:\njlnlxt.exec:\njlnlxt.exe32⤵
- Executes dropped EXE
-
\??\c:\dlljfbl.exec:\dlljfbl.exe33⤵
-
\??\c:\hhlftfr.exec:\hhlftfr.exe34⤵
- Executes dropped EXE
-
\??\c:\ttvnn.exec:\ttvnn.exe35⤵
- Executes dropped EXE
-
\??\c:\ljntj.exec:\ljntj.exe36⤵
- Executes dropped EXE
-
\??\c:\hnrdxf.exec:\hnrdxf.exe37⤵
- Executes dropped EXE
-
\??\c:\btbnddl.exec:\btbnddl.exe38⤵
- Executes dropped EXE
-
\??\c:\xnntv.exec:\xnntv.exe39⤵
- Executes dropped EXE
-
\??\c:\jbxtjh.exec:\jbxtjh.exe40⤵
- Executes dropped EXE
-
\??\c:\bvpnv.exec:\bvpnv.exe41⤵
- Executes dropped EXE
-
\??\c:\jlvxbb.exec:\jlvxbb.exe42⤵
- Executes dropped EXE
-
\??\c:\dprlvxv.exec:\dprlvxv.exe43⤵
- Executes dropped EXE
-
\??\c:\nxbbxxv.exec:\nxbbxxv.exe44⤵
- Executes dropped EXE
-
\??\c:\xpxlhf.exec:\xpxlhf.exe45⤵
- Executes dropped EXE
-
\??\c:\ttdrbtt.exec:\ttdrbtt.exe46⤵
- Executes dropped EXE
-
\??\c:\rxvlb.exec:\rxvlb.exe47⤵
- Executes dropped EXE
-
\??\c:\rdxrrv.exec:\rdxrrv.exe48⤵
- Executes dropped EXE
-
\??\c:\vltbb.exec:\vltbb.exe49⤵
- Executes dropped EXE
-
\??\c:\vnbhb.exec:\vnbhb.exe50⤵
- Executes dropped EXE
-
\??\c:\bjxhblt.exec:\bjxhblt.exe51⤵
- Executes dropped EXE
-
\??\c:\prtprf.exec:\prtprf.exe52⤵
- Executes dropped EXE
-
\??\c:\lrfjvl.exec:\lrfjvl.exe53⤵
- Executes dropped EXE
-
\??\c:\jrvjhrn.exec:\jrvjhrn.exe54⤵
- Executes dropped EXE
-
\??\c:\vfrnfv.exec:\vfrnfv.exe55⤵
- Executes dropped EXE
-
\??\c:\ndxprxd.exec:\ndxprxd.exe56⤵
- Executes dropped EXE
-
\??\c:\vllnnj.exec:\vllnnj.exe57⤵
- Executes dropped EXE
-
\??\c:\hdtllpn.exec:\hdtllpn.exe58⤵
- Executes dropped EXE
-
\??\c:\nrjjdlt.exec:\nrjjdlt.exe59⤵
- Executes dropped EXE
-
\??\c:\hjdlfj.exec:\hjdlfj.exe60⤵
- Executes dropped EXE
-
\??\c:\hpdpbr.exec:\hpdpbr.exe61⤵
- Executes dropped EXE
-
\??\c:\xthvhtb.exec:\xthvhtb.exe62⤵
- Executes dropped EXE
-
\??\c:\bbbrvtb.exec:\bbbrvtb.exe63⤵
- Executes dropped EXE
-
\??\c:\ltjpbt.exec:\ltjpbt.exe64⤵
- Executes dropped EXE
-
\??\c:\trfxj.exec:\trfxj.exe65⤵
- Executes dropped EXE
-
\??\c:\hdjdnph.exec:\hdjdnph.exe66⤵
- Executes dropped EXE
-
\??\c:\bhrdltf.exec:\bhrdltf.exe67⤵
-
\??\c:\xpbthpn.exec:\xpbthpn.exe68⤵
-
\??\c:\jtxltn.exec:\jtxltn.exe69⤵
-
\??\c:\txbtld.exec:\txbtld.exe70⤵
-
\??\c:\xjbxx.exec:\xjbxx.exe71⤵
- System Location Discovery: System Language Discovery
-
\??\c:\npffpxb.exec:\npffpxb.exe72⤵
-
\??\c:\bxfjbf.exec:\bxfjbf.exe73⤵
-
\??\c:\xdhfr.exec:\xdhfr.exe74⤵
-
\??\c:\jdbrlb.exec:\jdbrlb.exe75⤵
-
\??\c:\lfvtv.exec:\lfvtv.exe76⤵
-
\??\c:\fjrpfhl.exec:\fjrpfhl.exe77⤵
-
\??\c:\vphbrll.exec:\vphbrll.exe78⤵
-
\??\c:\nxjpxx.exec:\nxjpxx.exe79⤵
-
\??\c:\jxvdj.exec:\jxvdj.exe80⤵
-
\??\c:\ltnjfjr.exec:\ltnjfjr.exe81⤵
-
\??\c:\bfttxlj.exec:\bfttxlj.exe82⤵
-
\??\c:\vpbth.exec:\vpbth.exe83⤵
-
\??\c:\djftnjn.exec:\djftnjn.exe84⤵
-
\??\c:\vdxrd.exec:\vdxrd.exe85⤵
-
\??\c:\bxbrt.exec:\bxbrt.exe86⤵
-
\??\c:\rvbdvv.exec:\rvbdvv.exe87⤵
-
\??\c:\ldxnrfl.exec:\ldxnrfl.exe88⤵
-
\??\c:\lvxvr.exec:\lvxvr.exe89⤵
-
\??\c:\vxtfnv.exec:\vxtfnv.exe90⤵
-
\??\c:\bljbffx.exec:\bljbffx.exe91⤵
-
\??\c:\djtdljd.exec:\djtdljd.exe92⤵
-
\??\c:\lnrlj.exec:\lnrlj.exe93⤵
-
\??\c:\fdxhxx.exec:\fdxhxx.exe94⤵
-
\??\c:\hvjlt.exec:\hvjlt.exe95⤵
-
\??\c:\jdnxh.exec:\jdnxh.exe96⤵
-
\??\c:\pxjtj.exec:\pxjtj.exe97⤵
-
\??\c:\bhjvf.exec:\bhjvf.exe98⤵
-
\??\c:\lxxrtjl.exec:\lxxrtjl.exe99⤵
-
\??\c:\ttxfbb.exec:\ttxfbb.exe100⤵
-
\??\c:\thvrdl.exec:\thvrdl.exe101⤵
-
\??\c:\djhrtl.exec:\djhrtl.exe102⤵
-
\??\c:\bldbpb.exec:\bldbpb.exe103⤵
-
\??\c:\hrxphfx.exec:\hrxphfx.exe104⤵
-
\??\c:\lfbvp.exec:\lfbvp.exe105⤵
-
\??\c:\hhdprb.exec:\hhdprb.exe106⤵
-
\??\c:\xlhbrdn.exec:\xlhbrdn.exe107⤵
-
\??\c:\pdbhhfn.exec:\pdbhhfn.exe108⤵
-
\??\c:\bpvhj.exec:\bpvhj.exe109⤵
-
\??\c:\jtjpd.exec:\jtjpd.exe110⤵
-
\??\c:\nlrbv.exec:\nlrbv.exe111⤵
-
\??\c:\xrrdntj.exec:\xrrdntj.exe112⤵
-
\??\c:\ltlrttr.exec:\ltlrttr.exe113⤵
-
\??\c:\rdxbbrn.exec:\rdxbbrn.exe114⤵
-
\??\c:\bfxxdnr.exec:\bfxxdnr.exe115⤵
-
\??\c:\nthdnf.exec:\nthdnf.exe116⤵
-
\??\c:\tdvhthx.exec:\tdvhthx.exe117⤵
-
\??\c:\rntrp.exec:\rntrp.exe118⤵
-
\??\c:\lndjv.exec:\lndjv.exe119⤵
- System Location Discovery: System Language Discovery
-
\??\c:\brvvp.exec:\brvvp.exe120⤵
-
\??\c:\bdftjd.exec:\bdftjd.exe121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-