Analysis
- max time kernel
133s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
17/10/2024, 06:22
Errors
General
- Target 036f0d1325ee6eaef69b7de2c254f0565b30b16fb486addeb3ff829142d70ba3.exe
- Size 1.9MB
- Sample241017-g4xe8sygpj
- SHA256 036f0d1325ee6eaef69b7de2c254f0565b30b16fb486addeb3ff829142d70ba3
Malware Config
Signatures
- Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
- Detect Blackmoon payload 3 IoCs
- VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies data under HKEY_USERS 15 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\036f0d1325ee6eaef69b7de2c254f0565b30b16fb486addeb3ff829142d70ba3.exe"C:\Users\Admin\AppData\Local\Temp\036f0d1325ee6eaef69b7de2c254f0565b30b16fb486addeb3ff829142d70ba3.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa38ab055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1208-0-0x0000000000400000-0x0000000000908000-memory.dmp
memory/1208-1-0x0000000000400000-0x0000000000908000-memory.dmp
memory/1208-3-0x0000000076BD0000-0x0000000076BD1000-memory.dmp
memory/1208-4-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-19-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-50-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-47-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-52-0x0000000077E10000-0x0000000077E11000-memory.dmp
memory/1208-51-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-45-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-43-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-41-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-39-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-37-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-35-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-33-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-31-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-29-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-27-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-25-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-23-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-21-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-17-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-15-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-13-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-11-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-9-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-8-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-7-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-6-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-53-0x0000000000400000-0x0000000000908000-memory.dmp
memory/1208-54-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1208-55-0x0000000004CE0000-0x0000000004DDA000-memory.dmp
memory/1208-59-0x0000000004CE0000-0x0000000004DDA000-memory.dmp
memory/1208-67-0x0000000000400000-0x0000000000908000-memory.dmp