Analysis
-
max time kernel
149s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
12/10/2024, 18:10
General
-
Target
00a5475b60ecbaa8337291e95f80b852e9f122914233fcafdb4cbbc7029feaec.exe
-
Size
87KB
-
MD5
c7d17b278d95ff3dea74f0720e4da195
-
SHA1
7ee6c911db619a024b78925a40cf15798adaaeba
-
SHA256
00a5475b60ecbaa8337291e95f80b852e9f122914233fcafdb4cbbc7029feaec
-
SHA512
55b9ab35b6b4ca417427a5a1fa1d953f26efd5fcbef186f52cdf2e5ef9b100e68f2561f69a7ca4f98ed54ca7398000233479c0368b62421897d6fd9bbe181a41
-
SSDEEP
1536:z4hkM3Yz8wMZhUD2XsjEQWOSkE+Ct6WKBex3GWU5FkWp+AmQwKGSMdH+002I3/iQ:Mq6OLM3QasY5Ft71fqWWp+efGftm2I37
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\00a5475b60ecbaa8337291e95f80b852e9f122914233fcafdb4cbbc7029feaec.exe"C:\Users\Admin\AppData\Local\Temp\00a5475b60ecbaa8337291e95f80b852e9f122914233fcafdb4cbbc7029feaec.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Syslemwdnth.exe"C:\Users\Admin\AppData\Local\Temp\Syslemwdnth.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
102B
MD5a35d14bdcac5dd6f60b37f422fa34542
SHA1fbf279f822a15f9bdf68626827f7594c6202ec62
SHA25664220a1209e9115256df32d3a49e61e4756655c1a3c95574b452da9a6e3a3454
SHA5125a1c6e06ad2812066d5abdaf9da607797f75f54fe5536a57199be9dc3403557908ec816b19ef4a1589aaf5ac5bf95fa73f0477eb7aee1087ef1b80f01b0aa62b
-
Filesize
87KB
MD58a3ce2242a7826fd408b34d3a01349b7
SHA10f65eb39d542c178deb5ae4d1b5ee98df964da00
SHA256bfc670136f13417b05bf0f60268eae006656fde298f028677bbc9de22f1305cd
SHA5124f999b7b58163927911ba0f58090e6bfa3ef3c5a59b5b99ab8492729fc9fbc31254813508b08ce3187e0d16338c6a4386cf339c87c0aa377e2aa6792ba6dca95
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB