Analysis
-
max time kernel
95s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06-10-2024 11:01
General
-
Target
90d59daa5f72eda799486388b9eb35671e780545576b47107d66fbca586f8496.exe
-
Size
3.2MB
-
MD5
0eb0ac26b56abb31ff158ce3a737c3e4
-
SHA1
9ce4bc99fd3a8d35dc2dc7670f7ab6ec4a3f7670
-
SHA256
90d59daa5f72eda799486388b9eb35671e780545576b47107d66fbca586f8496
-
SHA512
502be310e9b3ac8977e801d3f73b65944c1fbe5b3e7ad0c915a4775b56d3b6d088970727f97dd0d09c9a9c846dfda4c3e98594984588ecc5a1d6be949fb8ce90
-
SSDEEP
24576:f4HH9GBtJr9YH6i4bJhHhVF0x4MZ591k9qzsqoJ2/Y/61oBhNdbxlypfWdvFe+Jz:fix4K2q82gVVdFApfOFTipzdUJ
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 3 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\90d59daa5f72eda799486388b9eb35671e780545576b47107d66fbca586f8496.exe"C:\Users\Admin\AppData\Local\Temp\90d59daa5f72eda799486388b9eb35671e780545576b47107d66fbca586f8496.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\admin.exec:\admin.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39B
MD5a9e9959bc43f4bdd1bbafde9b193dda5
SHA1f447f6611c8314771903ce2917f081fecf034c15
SHA2563cfbcbafc475708b124ca367a4cd6db2765d01a7d09e0b1638727ea3464c460e
SHA5124b0be0f74b7390fb8a5c98390b99cf1b05d28b6078c9de9186b0eb9146ad34822e69290478b3ec1ce59bfd56ac344de6a836a9270447e0a553028d87ba1f21dd
-
Filesize
372KB
MD59ed304603b3c00d5168b76a0b61332f0
SHA150f57ac837f9a325058a73181a4d33e2a66b4f8d
SHA2561ce90640766c1c1bb7d18fc94f429b794811d11d1a0b627696ab07f9075f7114
SHA512b96358c2c8950454c5ef17438ecd02525d116447af6ecefa9cdaaddd7b18634c46b23252d3d26f3c46c50df470ed9a405f652c53798e0d6a39c28f6a112d5af4
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
144KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
1.1MB
-
Filesize
1.1MB