Analysis

  • max time kernel
    141s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/11/2024, 22:51

General

  • Target

    4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe

  • Size

    6.9MB

  • MD5

    c8672e21806c9bb816590e91cd36a0ea

  • SHA1

    017599bcc927155437942032a9569bb1917fe728

  • SHA256

    4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c

  • SHA512

    a92c5cad91f884e62cf4618def7c35a35e9584adbce372a225c66d0db1dffe690ec0b4ccca1b8d681fde7d89d6a2207cf93b77212b07b4a7a6fdeb24c1f152a7

  • SSDEEP

    98304:GM/ncLgcqtoFpOzxTKtAj3m+YcEjT9s9o36:3/nxtfotA7ycEjTC

Malware Config

Signatures

  • Blackmoon family
  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 1 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe
    "C:\Users\Admin\AppData\Local\Temp\4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4952
    • C:\Users\Admin\AppData\Local\Temp\4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe
      C:\Users\Admin\AppData\Local\Temp\4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe 45063C065A06530675066306740675065A06470662066B066F0668065A0647067606760642066706720667065A065406690667066B066F06680661065A06670669066D066E0668065A06610668066506360662064D064B0659066406350635066C064306320674066B065A0631065C06330635066C064506670642063F06--aa`
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3312
      • C:\Users\Admin\AppData\Roaming\aokhn\gnc0dKM_b33jE4rm\7Z53jCaD9.exe
        "C:\Users\Admin\AppData\Roaming\aokhn\gnc0dKM_b33jE4rm\7Z53jCaD9.exe"
        3⤵
        • Adds policy Run key to start application
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:388

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\aokhn\gnc0dKM_b33jE4rm\7Z53jCaD9.exe

          Filesize

          146KB

          MD5

          ae1817f4788e6733af457bd5dff46289

          SHA1

          32ba5f36e80c28f256204fa3abda0ab2774d8af8

          SHA256

          08ccea61d93eb33675dffdeda73003d57b8f6710db4f9d98a5ec398a377101cd

          SHA512

          6c73589e5b2a540fa116cf11f8871acd4b0c391a22f6adad28ac07b9144150762faf6153cde82a2b661f93d4b9c36a73aff5438ebe31515869e79a397a6d1d01

        • C:\Users\Admin\AppData\Roaming\aokhn\gnc0dKM_b33jE4rm\7Z53jCaD9.txt

          Filesize

          493B

          MD5

          d1a1666b76cf5e9d8bd4f19e37801225

          SHA1

          e5bff206b78273c0b9fa12521915d1b66c0c6c2c

          SHA256

          c4db940cd209c6f53e65ea5ae2171e80273b9ad7c7a8756d70a74fdda7b74019

          SHA512

          c34b4c9e25adb903fe8c13a2e4841f5dbd666f5285559da21e1dbb4fdafe72154ac52d4e99d628de47744db4d73edd554c22184528001a4b29c284ae163ad6f2

        • C:\Users\Admin\AppData\Roaming\aokhn\gnc0dKM_b33jE4rm\Microsoft.WindowsAppRuntime.Bootstrap.dll

          Filesize

          3.2MB

          MD5

          5f8ed487eb810823682db34b48e9dc2a

          SHA1

          6a71057639c8e2689285ae188bb24a0e9779d344

          SHA256

          9c7117275638d9381bdb0ef53f589bd046bc43fb1f209c88763975804c13b55f

          SHA512

          6f1d3894652f8f6de6bbc866aceba31957707960f2912f297a214c9e46b1be752f63370c4ae84e57182b4583898bdc6a9e673d84060398e6c9b2fe6feeb9626c

        • memory/388-16-0x0000000000880000-0x0000000000881000-memory.dmp

          Filesize

          4KB

        • memory/388-22-0x0000000003EC0000-0x00000000040D1000-memory.dmp

          Filesize

          2.1MB

        • memory/388-18-0x00000000029F0000-0x0000000002AD7000-memory.dmp

          Filesize

          924KB

        • memory/388-17-0x00000000029F0000-0x0000000002AD7000-memory.dmp

          Filesize

          924KB

        • memory/388-20-0x00000000029F0000-0x0000000002AD7000-memory.dmp

          Filesize

          924KB

        • memory/388-14-0x00000000007E0000-0x00000000007E1000-memory.dmp

          Filesize

          4KB

        • memory/388-21-0x00000000029F0000-0x0000000002AD7000-memory.dmp

          Filesize

          924KB

        • memory/388-15-0x0000000000530000-0x0000000000531000-memory.dmp

          Filesize

          4KB

        • memory/388-26-0x00000000042F0000-0x00000000043DB000-memory.dmp

          Filesize

          940KB

        • memory/388-28-0x00000000049B0000-0x0000000004B25000-memory.dmp

          Filesize

          1.5MB

        • memory/388-30-0x00000000040F0000-0x00000000040F1000-memory.dmp

          Filesize

          4KB

        • memory/388-31-0x0000000003EC0000-0x00000000040D1000-memory.dmp

          Filesize

          2.1MB

        • memory/388-32-0x0000000004600000-0x0000000004652000-memory.dmp

          Filesize

          328KB

        • memory/388-33-0x0000000003EC0000-0x00000000040D1000-memory.dmp

          Filesize

          2.1MB