Analysis
-
max time kernel
142s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10/10/2024, 05:24
General
-
Target
c3f3b6d9d9c9cf28b1da9f6d36700e1018abe1bcf95e052879978786fd47e8b4.exe
-
Size
14.6MB
-
MD5
71a5bdbba9459a53a4a576b128caeac3
-
SHA1
b864162ee63d7712455e658ac6df0134cc37806c
-
SHA256
c3f3b6d9d9c9cf28b1da9f6d36700e1018abe1bcf95e052879978786fd47e8b4
-
SHA512
78a77aa4fda4c052e3edd15ee5828815e828f4f092b4d77c6d5238d107e7ace2c8ed00501ed49d7cec913cce377bd551964c475c6f505f6c418ef81a48a1ea20
-
SSDEEP
393216:iOpL7YRun1xp78qLoRWSYgbr559P93cQFWoK8tCxfprHHKe:1pLqiLp+YCr9PJZWQt495
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3f3b6d9d9c9cf28b1da9f6d36700e1018abe1bcf95e052879978786fd47e8b4.exe"C:\Users\Admin\AppData\Local\Temp\c3f3b6d9d9c9cf28b1da9f6d36700e1018abe1bcf95e052879978786fd47e8b4.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\¾ÅÎå±ùÑ©\31326c3f3b6d9d9c9cf28b1da9f6d36700e1018abe1bcf95e052879978786fd47e8b4.exeC:\¾ÅÎå±ùÑ©\31326c3f3b6d9d9c9cf28b1da9f6d36700e1018abe1bcf95e052879978786fd47e8b4.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12B
MD5d09e7a02312d181840b479f6bf390bcb
SHA12ec49315372528c0adac753e42c88aadc97151cf
SHA256616555e441a721acf674d017c71eec5b43707e3164e444cf22109af2d660f4c1
SHA5120fe4d312571f9e58998187c07056718f44c90677e5e139b5c788c73c552890d08b978fb0687274a7248ac86449b18d99c27e6e19160f11d9bf8399475c34afbc
-
Filesize
14.6MB
MD571a5bdbba9459a53a4a576b128caeac3
SHA1b864162ee63d7712455e658ac6df0134cc37806c
SHA256c3f3b6d9d9c9cf28b1da9f6d36700e1018abe1bcf95e052879978786fd47e8b4
SHA51278a77aa4fda4c052e3edd15ee5828815e828f4f092b4d77c6d5238d107e7ace2c8ed00501ed49d7cec913cce377bd551964c475c6f505f6c418ef81a48a1ea20
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.0MB
-
Filesize
12KB