Analysis
-
max time kernel
119s -
max time network
100s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
23-11-2024 18:27
General
-
Target
08659f2cc61c104f9eb6289bd07ae1a75bfce2425094026e0767f224805b976a.exe
-
Size
407KB
-
MD5
ea674bd1692f4fb8a0cd801bcef0d469
-
SHA1
f422c27a1ab1c73d1eb426169eb858ead0184019
-
SHA256
08659f2cc61c104f9eb6289bd07ae1a75bfce2425094026e0767f224805b976a
-
SHA512
5ff2f47a7d23f6dfe38e79371c22fd2e0571a9a56dab5e87c9a79c4176840f6e6026264446768206ae7bd684fb8931cd86778c4592d3c9feebfbe31ca8cbc4ea
-
SSDEEP
6144:K5/YZ58drqrhGcbLhmvjSN6jZhixVK/B/zIydenCU:K5/Q58drihGiLhmGNiZsx0B/zIkenCU
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\08659f2cc61c104f9eb6289bd07ae1a75bfce2425094026e0767f224805b976a.exe"C:\Users\Admin\AppData\Local\Temp\08659f2cc61c104f9eb6289bd07ae1a75bfce2425094026e0767f224805b976a.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Sysceamrilvz.exe"C:\Users\Admin\AppData\Local\Temp\Sysceamrilvz.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55a4c0fd5d1eba994934539e997d0c905
SHA1be11fecbbbb4f1a743b147267186220c635fc99c
SHA2561ab20cdd5171ca71b45820d3007362656a4688ad3e24a307aa21efcf1e19c4d6
SHA512a48f8b011fe1da57723efaeeb2fee18527a419fd94efa3868c9878a7c0e2a044c555841294626af26fef26b40fe61cdab2eacf32ea9e9d42bf9408499267d6eb
-
Filesize
471B
MD546f7b237bbb75ef043afad3d23908529
SHA1d5499c1a4f2a6dd24eb24514a213013718034141
SHA256a10541ed19a2ab59d094527e04de33f0eb5ace547d65287c300745d1b6b31dd2
SHA5120d84281bc79bbfd2e81f001227c8eeac24e33806e66e2589050420b2694b67aa3170d0a9aa26d075e8b6a24f22808a66fc4b919b3af4a8ce745e046fe7a1f77e
-
Filesize
471B
MD5fb5feb48eafcb383086dca8aca4025f6
SHA197084d331e2e419a59dc39d5c7ed598e1ebb79f2
SHA2566a6960a25637c3b8482de1c3b478252202d8e9b46d51e175d4b8ec1e43b616d6
SHA512c8614c044cbc3fd462849253acf982fe8309b46ed38d9e84c3995faf4c977f50d5793a4d5cc3fddce5dd13210b142d71015af47a156933289d32e8084a0c29d7
-
Filesize
1KB
MD55c8a1edf01986ababf189a2c80b73b43
SHA19d55b37038a34f1df9d1ab8e92f4a7083d0bcb9e
SHA2566c2db32803a6e378106fcc6143fdb61a072d4197b755ac61165bded0b15c608c
SHA51230692b1dac4d64064cb85b6548c4fcecd9c489a968b9ce7f8d09948ac7bf9349fd908c7592cc5f575b01636edeb800b4222423c91dab01c3c7c45368c31b57fe
-
Filesize
500B
MD58c5b836b667e46d835de9c73f33c11e2
SHA14e6b059397ccb863d61871e9bae4061fecb7e7a3
SHA25606ccff4e8ad81dac582b2c37cb030f600868887fff0b07ad7d0572decb2ce442
SHA512305ebd82b161acd7b99be58af555f6931b75ca1f5b403268ea393503a01dc110a403934ce0e5a82f4686a1219cc3bd159090af78eb3aac9653c9aac83e6fb5fe
-
Filesize
398B
MD5dc874303cc8b797ede0160a66e064ded
SHA106daafddecb6601af1d89038e3590f0603e35faf
SHA2568e8f419944aa122df3bb1dc16d94de3034c4557b669dfc989a0929643acc531f
SHA51267041cda1a0086a6d3f1655b5aad541e6a6571509faf4aab816b5f8432e03966cca291decfd9b8093d16bdf253d0408171a5b16d9a3699d3f8defa98fa8a2aae
-
Filesize
342B
MD5c772bb12a100dabcf5a3072c3f84817a
SHA1b61f8d9200ac8b3050ba293755c79b0828ce4c68
SHA2562cd27c08ae2c30b96b01bddc70fd60b8c4c5b0517a0521ce1c7a97e861961dcc
SHA512f46298ca3527377a51f61ae307770cf950f003e955f5be8cb6e1ad535c988f173d1dfa81fb0a008bef9ee1ab9d3381427f3212ff888d982255881c8e747f5379
-
Filesize
410B
MD55ff1cf05414fcedc84a6bd1546b0457b
SHA14e1c6e4591c71a1daa13f271ebe3bbfa7cdd3a32
SHA25601be8621dff483ed2ab3b6bcaf5017d12545ff68785ea2b356449a352a64678d
SHA51224532592ee1a9e05b57531244ad41ade8ebf131e6b32de955a36d2e37e3dd7a26678566c313eb4a3b20db934a371db93259ce4ce02dcba26117344478345d938
-
Filesize
536B
MD58707a451e50bfd610e47697c3b699690
SHA16cb1189e926266b16fec6ac0574a51daf297eb2f
SHA2561346631db1911277bef7f95a896cc69d1be6415d68ee5c0494ff0137d3ad172f
SHA5129d4970ae73f2c7c00f4ff8ec0f54dec91b7ed5a4694ca60afc85ae6c6dc9046b363bfb8ebf3335dfdcf66b4117c79fa2ee5d8a76a01fe2202213ab7aae15b433
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
102B
MD5cc98b9dbfcbd0dc77cc761187366936c
SHA1d53cb8343edec65b0477f6259bfedef7c5a058cc
SHA256aa96018c74edf48e6f350ce38ef988cf8b511dc5e49263d3ba08f318bdcd0189
SHA512d695bd348fac90e7f69d9aa144cba9d2b7f1bc513275b5e5d04e6dd98be27cedf6890fcad3d69a9b86c9d490838fbeab8ec6bf22dd9323cb763eab70ac33eadb
-
Filesize
407KB
MD526fb198b790ad6cc5ca2f50ad40d1d36
SHA1cc61e0b6d409ad9da91ac3bee02f99c4cf7af1f9
SHA256c6c988f46c4038f2d19a4d28957866e6d9d06e423563fc745a218db56774033d
SHA512060c64ddf1e4f553b5ce50bc33e1abe9fe4bc47f91ce2ed4c1eead5650bb37d443f9d27c94a580934c31af157a13a8165474f02b7fcca18a7bd4182ee4f3e735
-
Filesize
420KB
-
Filesize
420KB
-
Filesize
420KB
-
Filesize
420KB
-
Filesize
420KB