Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-11-2024 14:04
General
-
Target
3793aa821907cf6c0720a05728ab3969904c8e2eb9eac41c60338a0811af5af7N.exe
-
Size
453KB
-
MD5
542c948758cf875109247f384721b7c0
-
SHA1
d117411c1089314e74f126272acf398a7c45401b
-
SHA256
3793aa821907cf6c0720a05728ab3969904c8e2eb9eac41c60338a0811af5af7
-
SHA512
4a3168a14eb2bb2b540935ef10b0261a1a75c5f981a39a531675c2506deac53a571fa1bcb0909b46c6c4a9fa594fdb38bcc481f6afc04f13ee3d10231c873126
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeX:q7Tc2NYHUrAwfMp3CDX
Score
10/10
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 40 IoCs
-
Executes dropped EXE 64 IoCs
-
UPX packed file 45 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3793aa821907cf6c0720a05728ab3969904c8e2eb9eac41c60338a0811af5af7N.exe"C:\Users\Admin\AppData\Local\Temp\3793aa821907cf6c0720a05728ab3969904c8e2eb9eac41c60338a0811af5af7N.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\xrfflfl.exec:\xrfflfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btnntb.exec:\btnntb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnbbnh.exec:\tnbbnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrxflrl.exec:\rrxflrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5hhnbh.exec:\5hhnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3llrxxf.exec:\3llrxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5ntthh.exec:\5ntthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddppv.exec:\ddppv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9lxrxxf.exec:\9lxrxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7htthb.exec:\7htthb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdjpv.exec:\jdjpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnhnnb.exec:\bnhnnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7ddvd.exec:\7ddvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7frflxl.exec:\7frflxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3btttb.exec:\3btttb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjddp.exec:\pjddp.exe17⤵
- Executes dropped EXE
-
\??\c:\rlfrlrf.exec:\rlfrlrf.exe18⤵
- Executes dropped EXE
-
\??\c:\3nnbtb.exec:\3nnbtb.exe19⤵
- Executes dropped EXE
-
\??\c:\frrrxrf.exec:\frrrxrf.exe20⤵
- Executes dropped EXE
-
\??\c:\1rfrrlr.exec:\1rfrrlr.exe21⤵
- Executes dropped EXE
-
\??\c:\thtbhh.exec:\thtbhh.exe22⤵
- Executes dropped EXE
-
\??\c:\jdjjj.exec:\jdjjj.exe23⤵
- Executes dropped EXE
-
\??\c:\fxlllrr.exec:\fxlllrr.exe24⤵
- Executes dropped EXE
-
\??\c:\tnhntb.exec:\tnhntb.exe25⤵
- Executes dropped EXE
-
\??\c:\9pdvp.exec:\9pdvp.exe26⤵
- Executes dropped EXE
-
\??\c:\frlrxxl.exec:\frlrxxl.exe27⤵
- Executes dropped EXE
-
\??\c:\jjjdd.exec:\jjjdd.exe28⤵
- Executes dropped EXE
-
\??\c:\xlrrfff.exec:\xlrrfff.exe29⤵
- Executes dropped EXE
-
\??\c:\3thhhn.exec:\3thhhn.exe30⤵
- Executes dropped EXE
-
\??\c:\jpjvd.exec:\jpjvd.exe31⤵
- Executes dropped EXE
-
\??\c:\bbhhnt.exec:\bbhhnt.exe32⤵
- Executes dropped EXE
-
\??\c:\htnhhh.exec:\htnhhh.exe33⤵
- Executes dropped EXE
-
\??\c:\1jvvd.exec:\1jvvd.exe34⤵
- Executes dropped EXE
-
\??\c:\llflrxr.exec:\llflrxr.exe35⤵
- Executes dropped EXE
-
\??\c:\bthntt.exec:\bthntt.exe36⤵
- Executes dropped EXE
-
\??\c:\hhbttn.exec:\hhbttn.exe37⤵
- Executes dropped EXE
-
\??\c:\llrrxfl.exec:\llrrxfl.exe38⤵
- Executes dropped EXE
-
\??\c:\rfxfllr.exec:\rfxfllr.exe39⤵
- Executes dropped EXE
-
\??\c:\9hhtbb.exec:\9hhtbb.exe40⤵
- Executes dropped EXE
-
\??\c:\pjdjv.exec:\pjdjv.exe41⤵
- Executes dropped EXE
-
\??\c:\llxfrxr.exec:\llxfrxr.exe42⤵
- Executes dropped EXE
-
\??\c:\bbbtnt.exec:\bbbtnt.exe43⤵
- Executes dropped EXE
-
\??\c:\7bthhb.exec:\7bthhb.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\vvdvj.exec:\vvdvj.exe45⤵
- Executes dropped EXE
-
\??\c:\xxrrrxl.exec:\xxrrrxl.exe46⤵
- Executes dropped EXE
-
\??\c:\xrrxrxr.exec:\xrrxrxr.exe47⤵
- Executes dropped EXE
-
\??\c:\nbbbnt.exec:\nbbbnt.exe48⤵
- Executes dropped EXE
-
\??\c:\5pvpv.exec:\5pvpv.exe49⤵
- Executes dropped EXE
-
\??\c:\5vpvd.exec:\5vpvd.exe50⤵
- Executes dropped EXE
-
\??\c:\fxffrxf.exec:\fxffrxf.exe51⤵
- Executes dropped EXE
-
\??\c:\5bbnth.exec:\5bbnth.exe52⤵
- Executes dropped EXE
-
\??\c:\tnhnhn.exec:\tnhnhn.exe53⤵
- Executes dropped EXE
-
\??\c:\jvdpj.exec:\jvdpj.exe54⤵
- Executes dropped EXE
-
\??\c:\fxxlflf.exec:\fxxlflf.exe55⤵
- Executes dropped EXE
-
\??\c:\nthbtt.exec:\nthbtt.exe56⤵
- Executes dropped EXE
-
\??\c:\7jdjp.exec:\7jdjp.exe57⤵
- Executes dropped EXE
-
\??\c:\pvjvp.exec:\pvjvp.exe58⤵
- Executes dropped EXE
-
\??\c:\rlfrflx.exec:\rlfrflx.exe59⤵
- Executes dropped EXE
-
\??\c:\bnttnb.exec:\bnttnb.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\ppppj.exec:\ppppj.exe61⤵
- Executes dropped EXE
-
\??\c:\pjppd.exec:\pjppd.exe62⤵
- Executes dropped EXE
-
\??\c:\lrlrffl.exec:\lrlrffl.exe63⤵
- Executes dropped EXE
-
\??\c:\nbbnbh.exec:\nbbnbh.exe64⤵
- Executes dropped EXE
-
\??\c:\3pjvj.exec:\3pjvj.exe65⤵
- Executes dropped EXE
-
\??\c:\vvvjp.exec:\vvvjp.exe66⤵
-
\??\c:\lfxxxxl.exec:\lfxxxxl.exe67⤵
-
\??\c:\hbtbnt.exec:\hbtbnt.exe68⤵
-
\??\c:\djpvd.exec:\djpvd.exe69⤵
-
\??\c:\1dvdd.exec:\1dvdd.exe70⤵
-
\??\c:\fxrxflf.exec:\fxrxflf.exe71⤵
-
\??\c:\bthhnt.exec:\bthhnt.exe72⤵
-
\??\c:\btntbb.exec:\btntbb.exe73⤵
-
\??\c:\jjdjv.exec:\jjdjv.exe74⤵
-
\??\c:\xrlrrxr.exec:\xrlrrxr.exe75⤵
-
\??\c:\rllxfff.exec:\rllxfff.exe76⤵
-
\??\c:\nhnnnt.exec:\nhnnnt.exe77⤵
-
\??\c:\7ntbbb.exec:\7ntbbb.exe78⤵
-
\??\c:\jjpvv.exec:\jjpvv.exe79⤵
-
\??\c:\rxllrxl.exec:\rxllrxl.exe80⤵
-
\??\c:\jjddp.exec:\jjddp.exe81⤵
-
\??\c:\xxffllr.exec:\xxffllr.exe82⤵
-
\??\c:\nntbhn.exec:\nntbhn.exe83⤵
-
\??\c:\7ppdp.exec:\7ppdp.exe84⤵
-
\??\c:\lrffrrx.exec:\lrffrrx.exe85⤵
-
\??\c:\lfrrfrr.exec:\lfrrfrr.exe86⤵
-
\??\c:\nhtbhn.exec:\nhtbhn.exe87⤵
-
\??\c:\1vpdd.exec:\1vpdd.exe88⤵
-
\??\c:\xrlfffl.exec:\xrlfffl.exe89⤵
-
\??\c:\1lxfrxr.exec:\1lxfrxr.exe90⤵
-
\??\c:\1nhnbh.exec:\1nhnbh.exe91⤵
-
\??\c:\9lfrxxl.exec:\9lfrxxl.exe92⤵
-
\??\c:\7ntbnt.exec:\7ntbnt.exe93⤵
-
\??\c:\xrrxlxr.exec:\xrrxlxr.exe94⤵
-
\??\c:\btbbbt.exec:\btbbbt.exe95⤵
-
\??\c:\3dvdd.exec:\3dvdd.exe96⤵
-
\??\c:\rxxfxrl.exec:\rxxfxrl.exe97⤵
-
\??\c:\tttbtt.exec:\tttbtt.exe98⤵
-
\??\c:\pppvp.exec:\pppvp.exe99⤵
-
\??\c:\frfxxxf.exec:\frfxxxf.exe100⤵
-
\??\c:\htbntt.exec:\htbntt.exe101⤵
-
\??\c:\jpddj.exec:\jpddj.exe102⤵
-
\??\c:\1frrxfl.exec:\1frrxfl.exe103⤵
-
\??\c:\nbttnh.exec:\nbttnh.exe104⤵
-
\??\c:\dpjdj.exec:\dpjdj.exe105⤵
-
\??\c:\pdppd.exec:\pdppd.exe106⤵
-
\??\c:\3rfxrfr.exec:\3rfxrfr.exe107⤵
-
\??\c:\3hbhnn.exec:\3hbhnn.exe108⤵
-
\??\c:\vvppd.exec:\vvppd.exe109⤵
-
\??\c:\jdpjp.exec:\jdpjp.exe110⤵
-
\??\c:\rllfffr.exec:\rllfffr.exe111⤵
-
\??\c:\nbhbhh.exec:\nbhbhh.exe112⤵
-
\??\c:\djvpv.exec:\djvpv.exe113⤵
-
\??\c:\jjddv.exec:\jjddv.exe114⤵
-
\??\c:\xlfrxrf.exec:\xlfrxrf.exe115⤵
-
\??\c:\bbbhhh.exec:\bbbhhh.exe116⤵
-
\??\c:\ppjjv.exec:\ppjjv.exe117⤵
-
\??\c:\tbbnbt.exec:\tbbnbt.exe118⤵
-
\??\c:\5vjpp.exec:\5vjpp.exe119⤵
-
\??\c:\lfflrfr.exec:\lfflrfr.exe120⤵
- System Location Discovery: System Language Discovery
-
\??\c:\fxlxffr.exec:\fxlxffr.exe121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-