Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12/10/2024, 18:10
General
-
Target
00a5475b60ecbaa8337291e95f80b852e9f122914233fcafdb4cbbc7029feaec.exe
-
Size
87KB
-
MD5
c7d17b278d95ff3dea74f0720e4da195
-
SHA1
7ee6c911db619a024b78925a40cf15798adaaeba
-
SHA256
00a5475b60ecbaa8337291e95f80b852e9f122914233fcafdb4cbbc7029feaec
-
SHA512
55b9ab35b6b4ca417427a5a1fa1d953f26efd5fcbef186f52cdf2e5ef9b100e68f2561f69a7ca4f98ed54ca7398000233479c0368b62421897d6fd9bbe181a41
-
SSDEEP
1536:z4hkM3Yz8wMZhUD2XsjEQWOSkE+Ct6WKBex3GWU5FkWp+AmQwKGSMdH+002I3/iQ:Mq6OLM3QasY5Ft71fqWWp+efGftm2I37
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\00a5475b60ecbaa8337291e95f80b852e9f122914233fcafdb4cbbc7029feaec.exe"C:\Users\Admin\AppData\Local\Temp\00a5475b60ecbaa8337291e95f80b852e9f122914233fcafdb4cbbc7029feaec.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Syslemlukks.exe"C:\Users\Admin\AppData\Local\Temp\Syslemlukks.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD55d78862f0578a4b8099ef243eaa0462e
SHA1ba216cb5259e3afe389e670f192df30d5224adfe
SHA256710906cab25fe86163705112b8cbca5d78f36d163e89e0aa25232673bfd5c524
SHA51247689eae949cd7e6dcb149956a21ed644c97aafc673a9ef4840ac9d7a4990ef20f6728c1c2c759397078d841698b90f653a41a1ed1b376321c3ac6d794ca4c74
-
Filesize
102B
MD5a35d14bdcac5dd6f60b37f422fa34542
SHA1fbf279f822a15f9bdf68626827f7594c6202ec62
SHA25664220a1209e9115256df32d3a49e61e4756655c1a3c95574b452da9a6e3a3454
SHA5125a1c6e06ad2812066d5abdaf9da607797f75f54fe5536a57199be9dc3403557908ec816b19ef4a1589aaf5ac5bf95fa73f0477eb7aee1087ef1b80f01b0aa62b
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB