Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

6bffb9be72...8N.exe

windows7-x64

10

6bffb9be72...8N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2024, 17:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6bffb9be72d993adffad335bd84d9b77fe3b15ea732e0fa6be8cb22b7167a358N.exe

  • Size

    366KB

  • MD5

    42e9d48c7d070c62f785607676fb63f0

  • SHA1

    e9cbec400904cd7b1df76af08d38f8bf79e871ab

  • SHA256

    6bffb9be72d993adffad335bd84d9b77fe3b15ea732e0fa6be8cb22b7167a358

  • SHA512

    905170b1936150a5a1bc08f34f033fd2dac8aa13e9af4c9bc48eefb4209b84a0d9a7a6bcee653e7e50a168ab45b4ccd2e54b470ee24183f0f7c18da331c317cd

  • SSDEEP

    6144:BSfSHl+gv5gY1F53Aul/Egv4+E6qnwEGvIkJ7G9P1t:B2SHl+gv5gY1b5Eo4+EsEEIkJ7G9P1t

Score
10/10
blackmoonbankerdiscoverytrojan

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon
  • Detect Blackmoon payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6bffb9be72d993adffad335bd84d9b77fe3b15ea732e0fa6be8cb22b7167a358N.exe
    "C:\Users\Admin\AppData\Local\Temp\6bffb9be72d993adffad335bd84d9b77fe3b15ea732e0fa6be8cb22b7167a358N.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4224
    • C:\Users\Admin\AppData\Local\Temp\Syslemrkern.exe
      "C:\Users\Admin\AppData\Local\Temp\Syslemrkern.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4436
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4464,i,8231329449558834090,4540802069600791165,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:8
    1⤵
      PID:2024

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Syslemrkern.exe
      Filesize

      366KB

      MD5

      78d5fffa9cb77d75e4737a14c3df09bf

      SHA1

      76c6aeb93044a7d3764493c617cfc9bf4c9a04ea

      SHA256

      465f17449be41dd2c92ade95fce5de9c948f3ec2c1d752ffe2583e3b8b3bc592

      SHA512

      5b6b7c862be039746c28b2beb38717f658dd5e21eb37e04ecb80b5881174071a36049a347c3df98bdb2bd8c8dc862705fa20491bc3d77b6dc23b6c024eed9ce5

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\lpath.ini
      Filesize

      103B

      MD5

      cbb728848b85481227eb35ae1ef355bb

      SHA1

      6f1202436788a86151b4a9eee9b40d9b3ea6f616

      SHA256

      a6931730b7b02755d84099a04d4e60b3b36772d31f2d94f5fd9554500f179204

      SHA512

      78fde11f4df6e42ed3a7338a3c48cec1b288821c53dc21e2fc7a669a42e33496b82f54dfa5ab93055e411c7084f360e5af412a831ae03539d6999268cab67af5

      Download Submit