Analysis
-
max time kernel
140s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 09:30
General
-
Target
F2.exe
-
Size
703KB
-
MD5
b8650755ad9fccfd8bb689f5461fc782
-
SHA1
f7d36c280edf9c8114a06ad8171118bba96df207
-
SHA256
78733eaf03e5c92ac2dfb0ad80ee8cc1981b94a68ceda1f5e8aaceca640b7ee4
-
SHA512
cff24f06bcffeb18bf064a4cbd345b620cc6f8eefbbabd269c0c84d53bc649f08d65d0f062f2b7ea8ec9b60a495dd23496a9a4744eeb695ac4ec3dc728514e88
-
SSDEEP
12288:F/I7bYJkFv97jI6PMIR4A8D0A5nUrhjl3g2R/7kkL9l4OM0hB4qwLxAlnTJjWo+y:+bYO7X41TnUrfQYzkkzM0/4qwelnVW
Score
10/10
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\F2.exe"C:\Users\Admin\AppData\Local\Temp\F2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
-
Filesize
2.8MB