Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-11-2024 08:07
General
-
Target
a25a7ea81fe613939c111e833e3f6335406f788c2c73220d893d65b8919e61bb.exe
-
Size
3.3MB
-
MD5
9864f180fe6ba36961d20acb9f61ea62
-
SHA1
dae87fe5dac27c7340be6ee9928720af8c22b9df
-
SHA256
a25a7ea81fe613939c111e833e3f6335406f788c2c73220d893d65b8919e61bb
-
SHA512
c053c61035231752a409dffe4da1a9af2b0f8ceb0fcf265be685d7949f5c16f2424704b49a08e8d0e62d2355d1bbacd5fe92ebe7bc4cf894fcd5f8697f8dcac4
-
SSDEEP
98304:7S5ZkBnLE4okpzJOGESh8v67fPY6bGo1xElDiVZr0TDpP:S+LE4okpzJESOv6zYSGtDiVI
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 4 IoCs
-
UAC bypass 3 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 7 IoCs
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a25a7ea81fe613939c111e833e3f6335406f788c2c73220d893d65b8919e61bb.exe"C:\Users\Admin\AppData\Local\Temp\a25a7ea81fe613939c111e833e3f6335406f788c2c73220d893d65b8919e61bb.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Downloads\TGazUb.exeqLjLobexEOUyWsCi2⤵
- UAC bypass
- Deletes itself
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD59864f180fe6ba36961d20acb9f61ea62
SHA1dae87fe5dac27c7340be6ee9928720af8c22b9df
SHA256a25a7ea81fe613939c111e833e3f6335406f788c2c73220d893d65b8919e61bb
SHA512c053c61035231752a409dffe4da1a9af2b0f8ceb0fcf265be685d7949f5c16f2424704b49a08e8d0e62d2355d1bbacd5fe92ebe7bc4cf894fcd5f8697f8dcac4
-
Filesize
12.0MB
-
Filesize
3.8MB
-
Filesize
44KB
-
Filesize
260KB
-
Filesize
44KB
-
Filesize
12.0MB
-
Filesize
3.8MB
-
Filesize
260KB
-
Filesize
4KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
44KB
-
Filesize
3.8MB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
12.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12.0MB
-
Filesize
4KB
-
Filesize
3.8MB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
12.0MB
-
Filesize
44KB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
12.0MB