Analysis
-
max time kernel
140s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-10-2024 22:37
General
-
Target
Providence.exe
-
Size
142KB
-
MD5
7bd2b37e9639b54aa0648de2719d962b
-
SHA1
b3375ccbf620c16eddf8c9e580abf3e957cf164f
-
SHA256
b224faf3b809d73081b04bcfd75e3abf35ca305a00a6a210de316793887e3b66
-
SHA512
95a385a1f71c482325f7812e89acd407a45cc2228a8ae32bf811276eb9aae71df8d3836c0428d027db7e4d408511fe7174229fcd3db6d45e39df3b02bdb4bfcc
-
SSDEEP
1536:4qbJDBpABpyh0m0GDQhRhnh0R5Q/yRvihL1NC6kvlYqnYZV/3qh+dBp:fJXWyh0m0GDD5Q/yHvqqnYZV/3qh+5
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Providence.exe"C:\Users\Admin\AppData\Local\Temp\Providence.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
176KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
344KB
-
Filesize
7.7MB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
7.7MB