Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 10:13
General
-
Target
42912d0ab5bbd1d577d0a71ff0b21ecad69571a64cae33163778ad6e2da0fa2e.exe
-
Size
676KB
-
MD5
9ad5b2de0e61b8de9dfc187d8fb3a6f3
-
SHA1
59b7997aaf1d677db731e8a084e390e76c258175
-
SHA256
42912d0ab5bbd1d577d0a71ff0b21ecad69571a64cae33163778ad6e2da0fa2e
-
SHA512
300f2b1057bdadef1a760a6c36cc35816aca6114d215924d4a534614325fb8dbb759bca141c96208ff1af1747404361b986ac39702e3f797b6bc89600493f707
-
SSDEEP
12288:y4gDM4r3xJDRRX7My6LwOJ+XlMXYrUYj5VLScbwFtniBWPEaaPXJAq17MuANXGgd:yNDFHgycMXlMK/jj+cbA/PsXdeNXGM
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 4 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\42912d0ab5bbd1d577d0a71ff0b21ecad69571a64cae33163778ad6e2da0fa2e.exe"C:\Users\Admin\AppData\Local\Temp\42912d0ab5bbd1d577d0a71ff0b21ecad69571a64cae33163778ad6e2da0fa2e.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB