Analysis

  • max time kernel
    117s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02/11/2024, 22:51

General

  • Target

    4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe

  • Size

    6.9MB

  • MD5

    c8672e21806c9bb816590e91cd36a0ea

  • SHA1

    017599bcc927155437942032a9569bb1917fe728

  • SHA256

    4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c

  • SHA512

    a92c5cad91f884e62cf4618def7c35a35e9584adbce372a225c66d0db1dffe690ec0b4ccca1b8d681fde7d89d6a2207cf93b77212b07b4a7a6fdeb24c1f152a7

  • SSDEEP

    98304:GM/ncLgcqtoFpOzxTKtAj3m+YcEjT9s9o36:3/nxtfotA7ycEjTC

Malware Config

Signatures

  • Blackmoon family
  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 1 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe
    "C:\Users\Admin\AppData\Local\Temp\4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2324
    • C:\Users\Admin\AppData\Local\Temp\4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe
      C:\Users\Admin\AppData\Local\Temp\4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe 45063C065A06530675066306740675065A06470662066B066F0668065A0647067606760642066706720667065A065406690667066B066F06680661065A06670669066D066E0668065A063506480647067006300635065C06590662063F0664064D064E0636065A0635063F067E063E066E06420630067706500669065406--aa`
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1832
      • C:\Users\Admin\AppData\Roaming\aokhn\3NAv63Z_d9bKH0\39x8hD6qVoR.exe
        "C:\Users\Admin\AppData\Roaming\aokhn\3NAv63Z_d9bKH0\39x8hD6qVoR.exe"
        3⤵
        • Adds policy Run key to start application
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2708

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\aokhn\3NAv63Z_d9bKH0\39x8hD6qVoR.exe

          Filesize

          146KB

          MD5

          ae1817f4788e6733af457bd5dff46289

          SHA1

          32ba5f36e80c28f256204fa3abda0ab2774d8af8

          SHA256

          08ccea61d93eb33675dffdeda73003d57b8f6710db4f9d98a5ec398a377101cd

          SHA512

          6c73589e5b2a540fa116cf11f8871acd4b0c391a22f6adad28ac07b9144150762faf6153cde82a2b661f93d4b9c36a73aff5438ebe31515869e79a397a6d1d01

        • C:\Users\Admin\AppData\Roaming\aokhn\3NAv63Z_d9bKH0\39x8hD6qVoR.txt

          Filesize

          493B

          MD5

          d1a1666b76cf5e9d8bd4f19e37801225

          SHA1

          e5bff206b78273c0b9fa12521915d1b66c0c6c2c

          SHA256

          c4db940cd209c6f53e65ea5ae2171e80273b9ad7c7a8756d70a74fdda7b74019

          SHA512

          c34b4c9e25adb903fe8c13a2e4841f5dbd666f5285559da21e1dbb4fdafe72154ac52d4e99d628de47744db4d73edd554c22184528001a4b29c284ae163ad6f2

        • C:\Users\Admin\AppData\Roaming\aokhn\3NAv63Z_d9bKH0\Microsoft.WindowsAppRuntime.Bootstrap.dll

          Filesize

          3.2MB

          MD5

          5f8ed487eb810823682db34b48e9dc2a

          SHA1

          6a71057639c8e2689285ae188bb24a0e9779d344

          SHA256

          9c7117275638d9381bdb0ef53f589bd046bc43fb1f209c88763975804c13b55f

          SHA512

          6f1d3894652f8f6de6bbc866aceba31957707960f2912f297a214c9e46b1be752f63370c4ae84e57182b4583898bdc6a9e673d84060398e6c9b2fe6feeb9626c

        • memory/2708-23-0x0000000002750000-0x00000000027A6000-memory.dmp

          Filesize

          344KB

        • memory/2708-28-0x00000000036B0000-0x0000000003749000-memory.dmp

          Filesize

          612KB

        • memory/2708-14-0x0000000002210000-0x00000000022F7000-memory.dmp

          Filesize

          924KB

        • memory/2708-15-0x0000000002210000-0x00000000022F7000-memory.dmp

          Filesize

          924KB

        • memory/2708-17-0x0000000002210000-0x00000000022F7000-memory.dmp

          Filesize

          924KB

        • memory/2708-12-0x0000000000100000-0x0000000000101000-memory.dmp

          Filesize

          4KB

        • memory/2708-18-0x0000000002210000-0x00000000022F7000-memory.dmp

          Filesize

          924KB

        • memory/2708-19-0x00000000042E0000-0x00000000044F1000-memory.dmp

          Filesize

          2.1MB

        • memory/2708-24-0x00000000045D0000-0x00000000046BB000-memory.dmp

          Filesize

          940KB

        • memory/2708-11-0x0000000000110000-0x0000000000111000-memory.dmp

          Filesize

          4KB

        • memory/2708-25-0x00000000045D0000-0x00000000046BB000-memory.dmp

          Filesize

          940KB

        • memory/2708-13-0x0000000000120000-0x0000000000121000-memory.dmp

          Filesize

          4KB

        • memory/2708-31-0x0000000005000000-0x0000000005175000-memory.dmp

          Filesize

          1.5MB

        • memory/2708-29-0x0000000005000000-0x0000000005175000-memory.dmp

          Filesize

          1.5MB

        • memory/2708-32-0x0000000004500000-0x0000000004552000-memory.dmp

          Filesize

          328KB

        • memory/2708-33-0x0000000000370000-0x0000000000371000-memory.dmp

          Filesize

          4KB

        • memory/2708-34-0x00000000042E0000-0x00000000044F1000-memory.dmp

          Filesize

          2.1MB

        • memory/2708-35-0x0000000004500000-0x0000000004552000-memory.dmp

          Filesize

          328KB

        • memory/2708-36-0x00000000042E0000-0x00000000044F1000-memory.dmp

          Filesize

          2.1MB

        • memory/2708-37-0x0000000002750000-0x00000000027A6000-memory.dmp

          Filesize

          344KB

        • memory/2708-38-0x00000000045D0000-0x00000000046BB000-memory.dmp

          Filesize

          940KB

        • memory/2708-39-0x0000000005000000-0x0000000005175000-memory.dmp

          Filesize

          1.5MB

        • memory/2708-40-0x00000000036B0000-0x0000000003749000-memory.dmp

          Filesize

          612KB

        • memory/2708-41-0x0000000004500000-0x0000000004552000-memory.dmp

          Filesize

          328KB