Analysis

  • max time kernel
    137s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/11/2024, 22:55

General

  • Target

    4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe

  • Size

    6.9MB

  • MD5

    c8672e21806c9bb816590e91cd36a0ea

  • SHA1

    017599bcc927155437942032a9569bb1917fe728

  • SHA256

    4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c

  • SHA512

    a92c5cad91f884e62cf4618def7c35a35e9584adbce372a225c66d0db1dffe690ec0b4ccca1b8d681fde7d89d6a2207cf93b77212b07b4a7a6fdeb24c1f152a7

  • SSDEEP

    98304:GM/ncLgcqtoFpOzxTKtAj3m+YcEjT9s9o36:3/nxtfotA7ycEjTC

Malware Config

Signatures

  • Blackmoon family
  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 1 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe
    "C:\Users\Admin\AppData\Local\Temp\4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2392
    • C:\Users\Admin\AppData\Local\Temp\4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe
      C:\Users\Admin\AppData\Local\Temp\4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe 45063C065A06530675066306740675065A06470662066B066F0668065A0647067606760642066706720667065A065406690667066B066F06680661065A06670669066D066E0668065A064306440644067506500631066A066F066D065906730660064C065F063F064D066A063506320657065A064A0637065206420675063F066D06--aa`
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3724
      • C:\Users\Admin\AppData\Roaming\aokhn\EBBsV7lik_ufJY9Kl34Q\L1TDs9k.exe
        "C:\Users\Admin\AppData\Roaming\aokhn\EBBsV7lik_ufJY9Kl34Q\L1TDs9k.exe"
        3⤵
        • Adds policy Run key to start application
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3136

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\aokhn\EBBsV7lik_ufJY9Kl34Q\L1TDs9k.exe

          Filesize

          146KB

          MD5

          ae1817f4788e6733af457bd5dff46289

          SHA1

          32ba5f36e80c28f256204fa3abda0ab2774d8af8

          SHA256

          08ccea61d93eb33675dffdeda73003d57b8f6710db4f9d98a5ec398a377101cd

          SHA512

          6c73589e5b2a540fa116cf11f8871acd4b0c391a22f6adad28ac07b9144150762faf6153cde82a2b661f93d4b9c36a73aff5438ebe31515869e79a397a6d1d01

        • C:\Users\Admin\AppData\Roaming\aokhn\EBBsV7lik_ufJY9Kl34Q\L1TDs9k.txt

          Filesize

          493B

          MD5

          d1a1666b76cf5e9d8bd4f19e37801225

          SHA1

          e5bff206b78273c0b9fa12521915d1b66c0c6c2c

          SHA256

          c4db940cd209c6f53e65ea5ae2171e80273b9ad7c7a8756d70a74fdda7b74019

          SHA512

          c34b4c9e25adb903fe8c13a2e4841f5dbd666f5285559da21e1dbb4fdafe72154ac52d4e99d628de47744db4d73edd554c22184528001a4b29c284ae163ad6f2

        • C:\Users\Admin\AppData\Roaming\aokhn\EBBsV7lik_ufJY9Kl34Q\Microsoft.WindowsAppRuntime.Bootstrap.dll

          Filesize

          3.2MB

          MD5

          5f8ed487eb810823682db34b48e9dc2a

          SHA1

          6a71057639c8e2689285ae188bb24a0e9779d344

          SHA256

          9c7117275638d9381bdb0ef53f589bd046bc43fb1f209c88763975804c13b55f

          SHA512

          6f1d3894652f8f6de6bbc866aceba31957707960f2912f297a214c9e46b1be752f63370c4ae84e57182b4583898bdc6a9e673d84060398e6c9b2fe6feeb9626c

        • memory/3136-16-0x0000000002550000-0x0000000002551000-memory.dmp

          Filesize

          4KB

        • memory/3136-22-0x0000000004110000-0x0000000004321000-memory.dmp

          Filesize

          2.1MB

        • memory/3136-17-0x00000000028F0000-0x00000000029D7000-memory.dmp

          Filesize

          924KB

        • memory/3136-18-0x00000000028F0000-0x00000000029D7000-memory.dmp

          Filesize

          924KB

        • memory/3136-20-0x00000000028F0000-0x00000000029D7000-memory.dmp

          Filesize

          924KB

        • memory/3136-14-0x0000000000A70000-0x0000000000A71000-memory.dmp

          Filesize

          4KB

        • memory/3136-21-0x00000000028F0000-0x00000000029D7000-memory.dmp

          Filesize

          924KB

        • memory/3136-15-0x0000000000840000-0x0000000000841000-memory.dmp

          Filesize

          4KB

        • memory/3136-26-0x0000000004760000-0x000000000484B000-memory.dmp

          Filesize

          940KB

        • memory/3136-28-0x0000000004DA0000-0x0000000004F15000-memory.dmp

          Filesize

          1.5MB

        • memory/3136-30-0x0000000004360000-0x0000000004361000-memory.dmp

          Filesize

          4KB

        • memory/3136-31-0x0000000004110000-0x0000000004321000-memory.dmp

          Filesize

          2.1MB

        • memory/3136-32-0x0000000004C70000-0x0000000004CC2000-memory.dmp

          Filesize

          328KB

        • memory/3136-33-0x0000000004110000-0x0000000004321000-memory.dmp

          Filesize

          2.1MB