Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21/09/2024, 13:55
General
-
Target
6d1ae5d95a3c234f7954ce9fe10ad704842a863f8544d5156ecac8bcea68aed3N.exe
-
Size
230KB
-
MD5
2dd1e3632c6935aebbf9567fdb7c97a0
-
SHA1
509cd9d604f2dc3b2f5ed27813e4a1c23f16f12f
-
SHA256
6d1ae5d95a3c234f7954ce9fe10ad704842a863f8544d5156ecac8bcea68aed3
-
SHA512
6db7c7b36b2197a124c6c742d4f09633c71367def2e61c198dcf1561b8490904c137c3da193ef78077601f64f6b9dc709eac57faa9a09e969ddbe603970d3f9f
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLjBeG+F:n3C9BRo7MlrWKo+lxK6
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 25 IoCs
-
Executes dropped EXE 64 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d1ae5d95a3c234f7954ce9fe10ad704842a863f8544d5156ecac8bcea68aed3N.exe"C:\Users\Admin\AppData\Local\Temp\6d1ae5d95a3c234f7954ce9fe10ad704842a863f8544d5156ecac8bcea68aed3N.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\22262.exec:\22262.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\466420.exec:\466420.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7ttnbt.exec:\7ttnbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbtbnh.exec:\hbtbnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\8408608.exec:\8408608.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1btnbb.exec:\1btnbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\2404860.exec:\2404860.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffxflxx.exec:\ffxflxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjjvp.exec:\jjjvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\o026448.exec:\o026448.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frrxrlf.exec:\frrxrlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\w80044.exec:\w80044.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvpvv.exec:\pvpvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrxrrrx.exec:\xrxrrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5pvpd.exec:\5pvpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nthbnb.exec:\nthbnb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\g6268.exec:\g6268.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxffffx.exec:\xxffffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\824866.exec:\824866.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\04620.exec:\04620.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\624082.exec:\624082.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpvpj.exec:\jpvpj.exe23⤵
- Executes dropped EXE
-
\??\c:\5vpdv.exec:\5vpdv.exe24⤵
- Executes dropped EXE
-
\??\c:\86486.exec:\86486.exe25⤵
- Executes dropped EXE
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe26⤵
- Executes dropped EXE
-
\??\c:\86608.exec:\86608.exe27⤵
- Executes dropped EXE
-
\??\c:\1fxlxrl.exec:\1fxlxrl.exe28⤵
- Executes dropped EXE
-
\??\c:\o842040.exec:\o842040.exe29⤵
- Executes dropped EXE
-
\??\c:\262604.exec:\262604.exe30⤵
- Executes dropped EXE
-
\??\c:\nbhbnn.exec:\nbhbnn.exe31⤵
- Executes dropped EXE
-
\??\c:\nthnhh.exec:\nthnhh.exe32⤵
- Executes dropped EXE
-
\??\c:\vppdp.exec:\vppdp.exe33⤵
- Executes dropped EXE
-
\??\c:\vjvpd.exec:\vjvpd.exe34⤵
- Executes dropped EXE
-
\??\c:\g6608.exec:\g6608.exe35⤵
- Executes dropped EXE
-
\??\c:\vjjdp.exec:\vjjdp.exe36⤵
- Executes dropped EXE
-
\??\c:\jjjpd.exec:\jjjpd.exe37⤵
- Executes dropped EXE
-
\??\c:\hbbnhh.exec:\hbbnhh.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\6664860.exec:\6664860.exe39⤵
- Executes dropped EXE
-
\??\c:\rrxrflr.exec:\rrxrflr.exe40⤵
- Executes dropped EXE
-
\??\c:\thhbnn.exec:\thhbnn.exe41⤵
- Executes dropped EXE
-
\??\c:\dvdpp.exec:\dvdpp.exe42⤵
- Executes dropped EXE
-
\??\c:\662666.exec:\662666.exe43⤵
- Executes dropped EXE
-
\??\c:\o008226.exec:\o008226.exe44⤵
- Executes dropped EXE
-
\??\c:\vdjvj.exec:\vdjvj.exe45⤵
- Executes dropped EXE
-
\??\c:\xrfxffx.exec:\xrfxffx.exe46⤵
- Executes dropped EXE
-
\??\c:\002228.exec:\002228.exe47⤵
- Executes dropped EXE
-
\??\c:\c260826.exec:\c260826.exe48⤵
- Executes dropped EXE
-
\??\c:\6600004.exec:\6600004.exe49⤵
- Executes dropped EXE
-
\??\c:\82480.exec:\82480.exe50⤵
- Executes dropped EXE
-
\??\c:\866468.exec:\866468.exe51⤵
- Executes dropped EXE
-
\??\c:\8868264.exec:\8868264.exe52⤵
- Executes dropped EXE
-
\??\c:\06888.exec:\06888.exe53⤵
- Executes dropped EXE
-
\??\c:\a2608.exec:\a2608.exe54⤵
- Executes dropped EXE
-
\??\c:\hhttnn.exec:\hhttnn.exe55⤵
- Executes dropped EXE
-
\??\c:\ntbtbn.exec:\ntbtbn.exe56⤵
- Executes dropped EXE
-
\??\c:\686408.exec:\686408.exe57⤵
- Executes dropped EXE
-
\??\c:\284866.exec:\284866.exe58⤵
- Executes dropped EXE
-
\??\c:\pddvj.exec:\pddvj.exe59⤵
- Executes dropped EXE
-
\??\c:\g2044.exec:\g2044.exe60⤵
- Executes dropped EXE
-
\??\c:\jdvpv.exec:\jdvpv.exe61⤵
- Executes dropped EXE
-
\??\c:\7tnbnn.exec:\7tnbnn.exe62⤵
- Executes dropped EXE
-
\??\c:\6862684.exec:\6862684.exe63⤵
- Executes dropped EXE
-
\??\c:\frrfxlf.exec:\frrfxlf.exe64⤵
- Executes dropped EXE
-
\??\c:\628426.exec:\628426.exe65⤵
- Executes dropped EXE
-
\??\c:\5nnbnh.exec:\5nnbnh.exe66⤵
-
\??\c:\4048648.exec:\4048648.exe67⤵
-
\??\c:\462660.exec:\462660.exe68⤵
-
\??\c:\046060.exec:\046060.exe69⤵
-
\??\c:\6460080.exec:\6460080.exe70⤵
-
\??\c:\840482.exec:\840482.exe71⤵
-
\??\c:\o804260.exec:\o804260.exe72⤵
-
\??\c:\206044.exec:\206044.exe73⤵
-
\??\c:\djddv.exec:\djddv.exe74⤵
-
\??\c:\lllxfll.exec:\lllxfll.exe75⤵
-
\??\c:\w44866.exec:\w44866.exe76⤵
-
\??\c:\2020826.exec:\2020826.exe77⤵
-
\??\c:\5nbthb.exec:\5nbthb.exe78⤵
-
\??\c:\262648.exec:\262648.exe79⤵
-
\??\c:\2844822.exec:\2844822.exe80⤵
-
\??\c:\42264.exec:\42264.exe81⤵
-
\??\c:\pppjv.exec:\pppjv.exe82⤵
-
\??\c:\thbtht.exec:\thbtht.exe83⤵
-
\??\c:\3llxlfx.exec:\3llxlfx.exe84⤵
-
\??\c:\lrlxlfx.exec:\lrlxlfx.exe85⤵
-
\??\c:\6420046.exec:\6420046.exe86⤵
-
\??\c:\vpjdp.exec:\vpjdp.exe87⤵
-
\??\c:\6260860.exec:\6260860.exe88⤵
-
\??\c:\28624.exec:\28624.exe89⤵
-
\??\c:\hbthnb.exec:\hbthnb.exe90⤵
-
\??\c:\a2860.exec:\a2860.exe91⤵
-
\??\c:\9jdpj.exec:\9jdpj.exe92⤵
-
\??\c:\rxffxlr.exec:\rxffxlr.exe93⤵
-
\??\c:\86206.exec:\86206.exe94⤵
-
\??\c:\nbbbhb.exec:\nbbbhb.exe95⤵
-
\??\c:\q28082.exec:\q28082.exe96⤵
-
\??\c:\64044.exec:\64044.exe97⤵
-
\??\c:\262664.exec:\262664.exe98⤵
-
\??\c:\84264.exec:\84264.exe99⤵
-
\??\c:\084826.exec:\084826.exe100⤵
-
\??\c:\9ffxrrr.exec:\9ffxrrr.exe101⤵
-
\??\c:\62082.exec:\62082.exe102⤵
-
\??\c:\dpvjv.exec:\dpvjv.exe103⤵
-
\??\c:\8288060.exec:\8288060.exe104⤵
-
\??\c:\nbbnbt.exec:\nbbnbt.exe105⤵
-
\??\c:\6040806.exec:\6040806.exe106⤵
-
\??\c:\q88040.exec:\q88040.exe107⤵
-
\??\c:\48402.exec:\48402.exe108⤵
-
\??\c:\k44482.exec:\k44482.exe109⤵
-
\??\c:\6426606.exec:\6426606.exe110⤵
-
\??\c:\rlxxffl.exec:\rlxxffl.exe111⤵
-
\??\c:\5hhbtt.exec:\5hhbtt.exe112⤵
-
\??\c:\xlrrfll.exec:\xlrrfll.exe113⤵
-
\??\c:\bnbtbt.exec:\bnbtbt.exe114⤵
-
\??\c:\pdvjv.exec:\pdvjv.exe115⤵
-
\??\c:\xffrlrl.exec:\xffrlrl.exe116⤵
-
\??\c:\g8426.exec:\g8426.exe117⤵
-
\??\c:\llrxxxx.exec:\llrxxxx.exe118⤵
-
\??\c:\rlrlrll.exec:\rlrlrll.exe119⤵
-
\??\c:\8266042.exec:\8266042.exe120⤵
- System Location Discovery: System Language Discovery
-
\??\c:\866604.exec:\866604.exe121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-