Analysis
-
max time kernel
93s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-11-2024 07:39
General
-
Target
0346f345f16e7b839495a549c67e3606457382edcfb04574eb4f9d219ee7a376.exe
-
Size
4.5MB
-
MD5
55b01cee23328cb85bd994aa09c1dcdc
-
SHA1
a2ec3efca50011cb01cd254c6a69537f7321e175
-
SHA256
0346f345f16e7b839495a549c67e3606457382edcfb04574eb4f9d219ee7a376
-
SHA512
575e534da990c25aedb188ca4a86025df59c3e937da5b1fe700bb9f56d8cd29e22e1d46ebba2ea0dcfebd8f0a78926cd8365ffb1ae1524a2f426ded498f4d532
-
SSDEEP
98304:PQJDxAcHWNZflLRWPnq1adkZYZfc4vHP9Erm/:A7HEfVRH1fYZfc4fPWS
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 3 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0346f345f16e7b839495a549c67e3606457382edcfb04574eb4f9d219ee7a376.exe"C:\Users\Admin\AppData\Local\Temp\0346f345f16e7b839495a549c67e3606457382edcfb04574eb4f9d219ee7a376.exe"1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
-
Filesize
140KB
-
Filesize
88KB
-
Filesize
140KB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
88KB
-
Filesize
140KB
-
Filesize
960KB
-
Filesize
960KB