Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
22-11-2024 07:10
General
-
Target
7e4e29b7d7027c21edae5f9cc8f0f614f952fef37cc6ea1cc9bf15f86473149f.exe
-
Size
4.0MB
-
MD5
5020028bb304b5dfc8c9ddd49994a9e6
-
SHA1
2605f38546406f8f5dd5be0eff54cdd2692fc591
-
SHA256
7e4e29b7d7027c21edae5f9cc8f0f614f952fef37cc6ea1cc9bf15f86473149f
-
SHA512
8cfc2e17a6d4daae803dc5e39abd746b592656994f9517c6a5dd9c1a25f3e22604befdf68704420c0b524444786e9c4972fe0330e394c881ba4a2e8056015a14
-
SSDEEP
98304:LsswRnIDrGYZflLRWPnq1adkZYZfc4vzP9Frm:MIDffVRH1fYZfc47PTS
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 3 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e4e29b7d7027c21edae5f9cc8f0f614f952fef37cc6ea1cc9bf15f86473149f.exe"C:\Users\Admin\AppData\Local\Temp\7e4e29b7d7027c21edae5f9cc8f0f614f952fef37cc6ea1cc9bf15f86473149f.exe"1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
140KB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
140KB
-
Filesize
88KB
-
Filesize
140KB