Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19/09/2024, 08:06
General
-
Target
c16eb6670f29ff6665dfb026e4438c119c0c55e7b5d5d66aee9311a989615512N.exe
-
Size
80KB
-
MD5
8cfa8e7334c202857fb9677243a91c20
-
SHA1
2934bd7a067cce381bd1dda9e31bdcdb37f81553
-
SHA256
c16eb6670f29ff6665dfb026e4438c119c0c55e7b5d5d66aee9311a989615512
-
SHA512
af56a36b9ec45874db3435a817f5d1b6eb10396e5f0dc82cb648413d083faa925ac2c9fdbc8b4699135afe1e48150584d7ca8c8886e900da99de7fa2b2ac2886
-
SSDEEP
1536:ITJxjZZ29Up2U7O0Ov15+o46zqMi9G7WXnQQvaWh3zWKfx/t126a63H:SHZ2up5JkH+o46LuRXnLdpzp/tg6Z3H
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 61 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c16eb6670f29ff6665dfb026e4438c119c0c55e7b5d5d66aee9311a989615512N.exe"C:\Users\Admin\AppData\Local\Temp\c16eb6670f29ff6665dfb026e4438c119c0c55e7b5d5d66aee9311a989615512N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Syslemkpzkk.exe"C:\Users\Admin\AppData\Local\Temp\Syslemkpzkk.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
103B
MD5fe345ad5f8b23717307b0722b2e6be11
SHA11b898ac380f34691c357daa9d746df8060fb115d
SHA256dc3a6784497c84c75af526c02a22e0de7ac29b5315ed6077a74fbce81a86e8ce
SHA512fd76b0d9e282a1a42a583fe4b388fe39797c83106e01d8b68407cc21b71e24ae925e76fd66bf9a2d5320dd65630841474da0e7dfa93f31648e935a541efab317
-
Filesize
80KB
MD58235b6b9570dfce60fe0394fc02372e9
SHA17fe8ebd50aebb11ab03ff6f56eeffea795fdff40
SHA25643717ca9ef9ed8ca9e709bc126b60987a4f624d49e2b76542f663234a262970f
SHA5120a98bea86e8f8d5b1559e4d4d9b7cb419c033eb310d00663d49199490ed972f91e00481bc38e25df16b575036cbabb5b75ca37be33423d306f6628c405441498
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB