Analysis
-
max time kernel
119s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25/09/2024, 08:01
General
-
Target
0780e6bc986d6dc909afd000acf7cffe18d447ddbd6905ac0c03746e8bd74df2N.exe
-
Size
88KB
-
MD5
0fff0efa6b6ce9f1d4b246f68a7b37b0
-
SHA1
a2223ffed823efc5a8b9d512609f9d705dd44192
-
SHA256
0780e6bc986d6dc909afd000acf7cffe18d447ddbd6905ac0c03746e8bd74df2
-
SHA512
b3af05162e341bb4c9f2507aaf1a58d4dea6dd3c723e8944b2fb5c2ea9403c90f54d955c93ab3cfaba431488b2f6455f01f4b52463f36d39b6ff47a9db80e166
-
SSDEEP
1536:EF7p8VeHwYaBlAvXhRDtxY11686va0QgE9gHgMVnvLiDXs+0Q:K98VNTAP3BW1k81cLAUvLiDXsS
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0780e6bc986d6dc909afd000acf7cffe18d447ddbd6905ac0c03746e8bd74df2N.exe"C:\Users\Admin\AppData\Local\Temp\0780e6bc986d6dc909afd000acf7cffe18d447ddbd6905ac0c03746e8bd74df2N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Syslemlafsq.exe"C:\Users\Admin\AppData\Local\Temp\Syslemlafsq.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5ab2cb0e22ed8c477d00cf8689b54aeaf
SHA196d6e097fb21b17088cf16d322ff9f8996162a3a
SHA25696fee4815bc2aafdfe4dcf076f9c4d57460dfecf523edd3b7cb98225f3886c53
SHA5129a6e52a629234fefb68a5fbb4eaf9437bb21e7fdacd7beead3ba2db50b6e0196dcfd61c1c9896adfff302e44c89b5798ea6d8d4ae790e36b47dce570f74811b3
-
Filesize
103B
MD53e9cadc399b933f35bb7294643ee2518
SHA1f4a5f9d68eac8f9445cdffb8b3fbc7d8d255ca30
SHA2567bc996d427549bd86c01b15a6dd3766820f57de00f9312284cb974ec46a35679
SHA5123c1b8bcbb186c7d24127b454b3d0a3c782d630e83d672b1b623fc9d4546784bdac675a8ca642551c3145df4922749c0e4f74e5e230a505de8b5384ac7abd96d2
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB