Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
15/10/2024, 03:51
General
-
Target
2b6e3c1c4bde62efa441de16fedc9988811e3ca0f3fc24728b336ba5986661bcN.exe
-
Size
69KB
-
MD5
5a41971162bd74866ed0cdcea4acb2d0
-
SHA1
47edb1a711bed541854c1898d4544b6678eb6a28
-
SHA256
2b6e3c1c4bde62efa441de16fedc9988811e3ca0f3fc24728b336ba5986661bc
-
SHA512
ac0a0371a325430f7fa02a35efaad70a1374077b86c28aabc9a95c38ac431620309867cb2096493d3e763d93e4034e32e77dc8fab1693778ac6153886341775f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+Luvdp:ymb3NkkiQ3mdBjF0yMlip
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 21 IoCs
-
Executes dropped EXE 64 IoCs
-
UPX packed file 29 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b6e3c1c4bde62efa441de16fedc9988811e3ca0f3fc24728b336ba5986661bcN.exe"C:\Users\Admin\AppData\Local\Temp\2b6e3c1c4bde62efa441de16fedc9988811e3ca0f3fc24728b336ba5986661bcN.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\vhxtnhp.exec:\vhxtnhp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ljdjpb.exec:\ljdjpb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jtrlhvb.exec:\jtrlhvb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrphhd.exec:\rrphhd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ndjjf.exec:\ndjjf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djnvd.exec:\djnvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rnvhd.exec:\rnvhd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jlrtfh.exec:\jlrtfh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvxvtj.exec:\pvxvtj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tphdr.exec:\tphdr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ljvnnb.exec:\ljvnnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lvxtx.exec:\lvxtx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rbtpt.exec:\rbtpt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdhpx.exec:\jdhpx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fffxj.exec:\fffxj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bdprftl.exec:\bdprftl.exe17⤵
- Executes dropped EXE
-
\??\c:\rlljt.exec:\rlljt.exe18⤵
- Executes dropped EXE
-
\??\c:\nhlhx.exec:\nhlhx.exe19⤵
- Executes dropped EXE
-
\??\c:\xrvbh.exec:\xrvbh.exe20⤵
- Executes dropped EXE
-
\??\c:\ftrfp.exec:\ftrfp.exe21⤵
- Executes dropped EXE
-
\??\c:\xpnjh.exec:\xpnjh.exe22⤵
- Executes dropped EXE
-
\??\c:\hnvvnjp.exec:\hnvvnjp.exe23⤵
- Executes dropped EXE
-
\??\c:\jfdnj.exec:\jfdnj.exe24⤵
- Executes dropped EXE
-
\??\c:\xbxvrr.exec:\xbxvrr.exe25⤵
- Executes dropped EXE
-
\??\c:\xnxtf.exec:\xnxtf.exe26⤵
- Executes dropped EXE
-
\??\c:\prxlrpv.exec:\prxlrpv.exe27⤵
- Executes dropped EXE
-
\??\c:\rbjvt.exec:\rbjvt.exe28⤵
- Executes dropped EXE
-
\??\c:\lptvtd.exec:\lptvtd.exe29⤵
- Executes dropped EXE
-
\??\c:\jdtfjx.exec:\jdtfjx.exe30⤵
- Executes dropped EXE
-
\??\c:\rxrpn.exec:\rxrpn.exe31⤵
- Executes dropped EXE
-
\??\c:\pxnltb.exec:\pxnltb.exe32⤵
- Executes dropped EXE
-
\??\c:\jlbjtr.exec:\jlbjtr.exe33⤵
- Executes dropped EXE
-
\??\c:\thbjbl.exec:\thbjbl.exe34⤵
- Executes dropped EXE
-
\??\c:\lxxbn.exec:\lxxbn.exe35⤵
- Executes dropped EXE
-
\??\c:\bfdvrd.exec:\bfdvrd.exe36⤵
- Executes dropped EXE
-
\??\c:\frtld.exec:\frtld.exe37⤵
- Executes dropped EXE
-
\??\c:\lhdvthh.exec:\lhdvthh.exe38⤵
- Executes dropped EXE
-
\??\c:\jltljn.exec:\jltljn.exe39⤵
- Executes dropped EXE
-
\??\c:\djrjd.exec:\djrjd.exe40⤵
- Executes dropped EXE
-
\??\c:\flltp.exec:\flltp.exe41⤵
- Executes dropped EXE
-
\??\c:\hplrlll.exec:\hplrlll.exe42⤵
- Executes dropped EXE
-
\??\c:\xbfxv.exec:\xbfxv.exe43⤵
- Executes dropped EXE
-
\??\c:\xvlvn.exec:\xvlvn.exe44⤵
- Executes dropped EXE
-
\??\c:\rptjb.exec:\rptjb.exe45⤵
- Executes dropped EXE
-
\??\c:\nhlxfh.exec:\nhlxfh.exe46⤵
- Executes dropped EXE
-
\??\c:\vrptpln.exec:\vrptpln.exe47⤵
- Executes dropped EXE
-
\??\c:\vfpfv.exec:\vfpfv.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\dxblt.exec:\dxblt.exe49⤵
- Executes dropped EXE
-
\??\c:\lnvvbvt.exec:\lnvvbvt.exe50⤵
- Executes dropped EXE
-
\??\c:\tfxtrnr.exec:\tfxtrnr.exe51⤵
- Executes dropped EXE
-
\??\c:\hlddh.exec:\hlddh.exe52⤵
- Executes dropped EXE
-
\??\c:\jhpft.exec:\jhpft.exe53⤵
- Executes dropped EXE
-
\??\c:\nrttlrd.exec:\nrttlrd.exe54⤵
- Executes dropped EXE
-
\??\c:\fdvltf.exec:\fdvltf.exe55⤵
- Executes dropped EXE
-
\??\c:\flpbnn.exec:\flpbnn.exe56⤵
- Executes dropped EXE
-
\??\c:\xdljrt.exec:\xdljrt.exe57⤵
- Executes dropped EXE
-
\??\c:\ffnvxtt.exec:\ffnvxtt.exe58⤵
- Executes dropped EXE
-
\??\c:\xxnjn.exec:\xxnjn.exe59⤵
- Executes dropped EXE
-
\??\c:\rrdtbf.exec:\rrdtbf.exe60⤵
- Executes dropped EXE
-
\??\c:\rbttxb.exec:\rbttxb.exe61⤵
- Executes dropped EXE
-
\??\c:\tfhdvfj.exec:\tfhdvfj.exe62⤵
- Executes dropped EXE
-
\??\c:\lnjjtrj.exec:\lnjjtrj.exe63⤵
- Executes dropped EXE
-
\??\c:\hdhdn.exec:\hdhdn.exe64⤵
- Executes dropped EXE
-
\??\c:\tlpnd.exec:\tlpnd.exe65⤵
- Executes dropped EXE
-
\??\c:\bhfjjjh.exec:\bhfjjjh.exe66⤵
-
\??\c:\pbtdlx.exec:\pbtdlx.exe67⤵
-
\??\c:\lxfbx.exec:\lxfbx.exe68⤵
-
\??\c:\rbtvtpt.exec:\rbtvtpt.exe69⤵
-
\??\c:\pbhblxt.exec:\pbhblxt.exe70⤵
-
\??\c:\rtjdjh.exec:\rtjdjh.exe71⤵
-
\??\c:\lntbdv.exec:\lntbdv.exe72⤵
-
\??\c:\bdbfphd.exec:\bdbfphd.exe73⤵
-
\??\c:\jdtrl.exec:\jdtrl.exe74⤵
-
\??\c:\pxfhbx.exec:\pxfhbx.exe75⤵
-
\??\c:\fddhltp.exec:\fddhltp.exe76⤵
-
\??\c:\xvplhxl.exec:\xvplhxl.exe77⤵
-
\??\c:\nxlpvdl.exec:\nxlpvdl.exe78⤵
-
\??\c:\xddbh.exec:\xddbh.exe79⤵
-
\??\c:\bvjddrx.exec:\bvjddrx.exe80⤵
-
\??\c:\hxfxn.exec:\hxfxn.exe81⤵
-
\??\c:\pbpnd.exec:\pbpnd.exe82⤵
-
\??\c:\vrtnvt.exec:\vrtnvt.exe83⤵
-
\??\c:\fjbdf.exec:\fjbdf.exe84⤵
-
\??\c:\pldxd.exec:\pldxd.exe85⤵
-
\??\c:\ddtdnv.exec:\ddtdnv.exe86⤵
-
\??\c:\vrbrldj.exec:\vrbrldj.exe87⤵
-
\??\c:\tjjnvfl.exec:\tjjnvfl.exe88⤵
-
\??\c:\jtxjtbr.exec:\jtxjtbr.exe89⤵
-
\??\c:\fnjfrld.exec:\fnjfrld.exe90⤵
-
\??\c:\jtnpbvd.exec:\jtnpbvd.exe91⤵
-
\??\c:\dndld.exec:\dndld.exe92⤵
-
\??\c:\dptnptr.exec:\dptnptr.exe93⤵
-
\??\c:\vjfjrv.exec:\vjfjrv.exe94⤵
-
\??\c:\fddpf.exec:\fddpf.exe95⤵
-
\??\c:\xjrnn.exec:\xjrnn.exe96⤵
-
\??\c:\pfjltdd.exec:\pfjltdd.exe97⤵
-
\??\c:\nlprxnj.exec:\nlprxnj.exe98⤵
-
\??\c:\tvhvtbt.exec:\tvhvtbt.exe99⤵
-
\??\c:\trlbbl.exec:\trlbbl.exe100⤵
-
\??\c:\fxbrtxn.exec:\fxbrtxn.exe101⤵
-
\??\c:\rfjft.exec:\rfjft.exe102⤵
-
\??\c:\xdftdv.exec:\xdftdv.exe103⤵
-
\??\c:\nfvjb.exec:\nfvjb.exe104⤵
-
\??\c:\rdrpl.exec:\rdrpl.exe105⤵
-
\??\c:\xpvpvh.exec:\xpvpvh.exe106⤵
-
\??\c:\jfxfbh.exec:\jfxfbh.exe107⤵
-
\??\c:\xhrvtff.exec:\xhrvtff.exe108⤵
-
\??\c:\vxhttt.exec:\vxhttt.exe109⤵
-
\??\c:\pvprbtd.exec:\pvprbtd.exe110⤵
-
\??\c:\jvtltlp.exec:\jvtltlp.exe111⤵
-
\??\c:\tljrjx.exec:\tljrjx.exe112⤵
-
\??\c:\htdllj.exec:\htdllj.exe113⤵
-
\??\c:\pvhbtvn.exec:\pvhbtvn.exe114⤵
-
\??\c:\dfdln.exec:\dfdln.exe115⤵
-
\??\c:\flvjjjh.exec:\flvjjjh.exe116⤵
-
\??\c:\plxpl.exec:\plxpl.exe117⤵
-
\??\c:\rfhjj.exec:\rfhjj.exe118⤵
-
\??\c:\txtxdr.exec:\txtxdr.exe119⤵
- System Location Discovery: System Language Discovery
-
\??\c:\nlvbrvv.exec:\nlvbrvv.exe120⤵
-
\??\c:\rxpph.exec:\rxpph.exe121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-