Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-10-2024 12:19
General
-
Target
138ca5d0d004bb9fe69a9e1421b9bf9808ccffcda6cfb35c5ac28a413bc907caN.exe
-
Size
71KB
-
MD5
a9a021d58ca4d986043a6f294e5c6540
-
SHA1
4c90fbd0e006777e408762a02da2adf0601a8f6d
-
SHA256
138ca5d0d004bb9fe69a9e1421b9bf9808ccffcda6cfb35c5ac28a413bc907ca
-
SHA512
ba73e7a01230c229039ae9c8bc9ce8ebf618cc2c84f59800c88e5238ab5f59024cc651b6f69eb3097906f684816e3a581a3c96fa4f03e672ed216b421a01e205
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjD:ymb3NkkiQ3mdBjFI4VT
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 26 IoCs
-
Executes dropped EXE 64 IoCs
-
UPX packed file 33 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\138ca5d0d004bb9fe69a9e1421b9bf9808ccffcda6cfb35c5ac28a413bc907caN.exe"C:\Users\Admin\AppData\Local\Temp\138ca5d0d004bb9fe69a9e1421b9bf9808ccffcda6cfb35c5ac28a413bc907caN.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\hhhbbh.exec:\hhhbbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3pdvp.exec:\3pdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdjvd.exec:\pdjvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htbhbb.exec:\htbhbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjddp.exec:\pjddp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdvvj.exec:\jdvvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfffrrf.exec:\lfffrrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnnnnn.exec:\tnnnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhttth.exec:\hhttth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpdvv.exec:\vpdvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlrffll.exec:\rlrffll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbhhbb.exec:\nbhhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htttbb.exec:\htttbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjvpj.exec:\vjvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xllffff.exec:\xllffff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbtbh.exec:\nhbtbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttbbnt.exec:\ttbbnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjddv.exec:\pjddv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9fllflf.exec:\9fllflf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrlffxx.exec:\rrlffxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbhhnt.exec:\bbhhnt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjvvv.exec:\pjvvv.exe23⤵
- Executes dropped EXE
-
\??\c:\ppdvp.exec:\ppdvp.exe24⤵
- Executes dropped EXE
-
\??\c:\xfllxff.exec:\xfllxff.exe25⤵
- Executes dropped EXE
-
\??\c:\rrfllxx.exec:\rrfllxx.exe26⤵
- Executes dropped EXE
-
\??\c:\tttthn.exec:\tttthn.exe27⤵
- Executes dropped EXE
-
\??\c:\pdvpv.exec:\pdvpv.exe28⤵
- Executes dropped EXE
-
\??\c:\ffllrxr.exec:\ffllrxr.exe29⤵
- Executes dropped EXE
-
\??\c:\bthbnb.exec:\bthbnb.exe30⤵
- Executes dropped EXE
-
\??\c:\ppvvp.exec:\ppvvp.exe31⤵
- Executes dropped EXE
-
\??\c:\vjddv.exec:\vjddv.exe32⤵
- Executes dropped EXE
-
\??\c:\xffllxf.exec:\xffllxf.exe33⤵
- Executes dropped EXE
-
\??\c:\tthhhn.exec:\tthhhn.exe34⤵
- Executes dropped EXE
-
\??\c:\nhnhhh.exec:\nhnhhh.exe35⤵
- Executes dropped EXE
-
\??\c:\dpdjd.exec:\dpdjd.exe36⤵
- Executes dropped EXE
-
\??\c:\fxxxrlf.exec:\fxxxrlf.exe37⤵
- Executes dropped EXE
-
\??\c:\bttnhh.exec:\bttnhh.exe38⤵
- Executes dropped EXE
-
\??\c:\1ttthn.exec:\1ttthn.exe39⤵
- Executes dropped EXE
-
\??\c:\dvdvv.exec:\dvdvv.exe40⤵
- Executes dropped EXE
-
\??\c:\3fflfll.exec:\3fflfll.exe41⤵
- Executes dropped EXE
-
\??\c:\nhbbtt.exec:\nhbbtt.exe42⤵
- Executes dropped EXE
-
\??\c:\hnnnbt.exec:\hnnnbt.exe43⤵
- Executes dropped EXE
-
\??\c:\dvjdv.exec:\dvjdv.exe44⤵
- Executes dropped EXE
-
\??\c:\rlfrllf.exec:\rlfrllf.exe45⤵
- Executes dropped EXE
-
\??\c:\tbhhbb.exec:\tbhhbb.exe46⤵
- Executes dropped EXE
-
\??\c:\vpvvp.exec:\vpvvp.exe47⤵
- Executes dropped EXE
-
\??\c:\djvpp.exec:\djvpp.exe48⤵
- Executes dropped EXE
-
\??\c:\3lfxllr.exec:\3lfxllr.exe49⤵
- Executes dropped EXE
-
\??\c:\btnhbt.exec:\btnhbt.exe50⤵
- Executes dropped EXE
-
\??\c:\jjvvv.exec:\jjvvv.exe51⤵
- Executes dropped EXE
-
\??\c:\fxxrrll.exec:\fxxrrll.exe52⤵
- Executes dropped EXE
-
\??\c:\hnbtnt.exec:\hnbtnt.exe53⤵
- Executes dropped EXE
-
\??\c:\nnttnn.exec:\nnttnn.exe54⤵
- Executes dropped EXE
-
\??\c:\3xxxxff.exec:\3xxxxff.exe55⤵
- Executes dropped EXE
-
\??\c:\vvdjp.exec:\vvdjp.exe56⤵
- Executes dropped EXE
-
\??\c:\fllfxfx.exec:\fllfxfx.exe57⤵
- Executes dropped EXE
-
\??\c:\btbbtt.exec:\btbbtt.exe58⤵
- Executes dropped EXE
-
\??\c:\jddvv.exec:\jddvv.exe59⤵
- Executes dropped EXE
-
\??\c:\ffxxxfx.exec:\ffxxxfx.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\llxxffr.exec:\llxxffr.exe61⤵
- Executes dropped EXE
-
\??\c:\tbtnnn.exec:\tbtnnn.exe62⤵
- Executes dropped EXE
-
\??\c:\llxfrff.exec:\llxfrff.exe63⤵
- Executes dropped EXE
-
\??\c:\llrllll.exec:\llrllll.exe64⤵
- Executes dropped EXE
-
\??\c:\tbnhhh.exec:\tbnhhh.exe65⤵
- Executes dropped EXE
-
\??\c:\jpvvd.exec:\jpvvd.exe66⤵
-
\??\c:\vvvpp.exec:\vvvpp.exe67⤵
-
\??\c:\rxlflll.exec:\rxlflll.exe68⤵
-
\??\c:\lfxxffr.exec:\lfxxffr.exe69⤵
-
\??\c:\hbbhbb.exec:\hbbhbb.exe70⤵
-
\??\c:\jpddv.exec:\jpddv.exe71⤵
-
\??\c:\vjpjd.exec:\vjpjd.exe72⤵
-
\??\c:\llllxfx.exec:\llllxfx.exe73⤵
-
\??\c:\5ttttb.exec:\5ttttb.exe74⤵
-
\??\c:\vpppj.exec:\vpppj.exe75⤵
-
\??\c:\xrlllrr.exec:\xrlllrr.exe76⤵
-
\??\c:\xxrxxrr.exec:\xxrxxrr.exe77⤵
-
\??\c:\nhnnnt.exec:\nhnnnt.exe78⤵
-
\??\c:\pdjjj.exec:\pdjjj.exe79⤵
-
\??\c:\jdpjv.exec:\jdpjv.exe80⤵
-
\??\c:\xfrllrr.exec:\xfrllrr.exe81⤵
-
\??\c:\3lfxrff.exec:\3lfxrff.exe82⤵
-
\??\c:\nnhtth.exec:\nnhtth.exe83⤵
-
\??\c:\vvpvv.exec:\vvpvv.exe84⤵
-
\??\c:\lrxrlll.exec:\lrxrlll.exe85⤵
-
\??\c:\rfrllll.exec:\rfrllll.exe86⤵
-
\??\c:\hbnnnt.exec:\hbnnnt.exe87⤵
-
\??\c:\djvvj.exec:\djvvj.exe88⤵
-
\??\c:\rlffflr.exec:\rlffflr.exe89⤵
-
\??\c:\lrlllll.exec:\lrlllll.exe90⤵
-
\??\c:\tbttth.exec:\tbttth.exe91⤵
-
\??\c:\ppjjv.exec:\ppjjv.exe92⤵
-
\??\c:\fflfxxr.exec:\fflfxxr.exe93⤵
-
\??\c:\rffxrrl.exec:\rffxrrl.exe94⤵
-
\??\c:\bhhhtb.exec:\bhhhtb.exe95⤵
-
\??\c:\vvjjd.exec:\vvjjd.exe96⤵
-
\??\c:\jdppj.exec:\jdppj.exe97⤵
-
\??\c:\xxlflxr.exec:\xxlflxr.exe98⤵
-
\??\c:\nnntnt.exec:\nnntnt.exe99⤵
-
\??\c:\bbbhbh.exec:\bbbhbh.exe100⤵
-
\??\c:\9jvjd.exec:\9jvjd.exe101⤵
-
\??\c:\5pvdv.exec:\5pvdv.exe102⤵
-
\??\c:\xxffllf.exec:\xxffllf.exe103⤵
-
\??\c:\hthhhb.exec:\hthhhb.exe104⤵
-
\??\c:\xlllxxr.exec:\xlllxxr.exe105⤵
-
\??\c:\lflllll.exec:\lflllll.exe106⤵
-
\??\c:\hnnhbn.exec:\hnnhbn.exe107⤵
-
\??\c:\pdjdv.exec:\pdjdv.exe108⤵
-
\??\c:\vpddv.exec:\vpddv.exe109⤵
-
\??\c:\xfxxrrl.exec:\xfxxrrl.exe110⤵
-
\??\c:\tntnhh.exec:\tntnhh.exe111⤵
-
\??\c:\nntthh.exec:\nntthh.exe112⤵
-
\??\c:\jppjd.exec:\jppjd.exe113⤵
-
\??\c:\vvpjj.exec:\vvpjj.exe114⤵
-
\??\c:\fffxrrr.exec:\fffxrrr.exe115⤵
-
\??\c:\bbbhhh.exec:\bbbhhh.exe116⤵
-
\??\c:\ddvpj.exec:\ddvpj.exe117⤵
-
\??\c:\jjpjp.exec:\jjpjp.exe118⤵
-
\??\c:\xlffxxx.exec:\xlffxxx.exe119⤵
-
\??\c:\rlrxrxx.exec:\rlrxrxx.exe120⤵
- System Location Discovery: System Language Discovery
-
\??\c:\ttbbbb.exec:\ttbbbb.exe121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-