Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24-11-2024 13:05
General
-
Target
cs2（解压我出来）/2.辅助.exe
-
Size
12.4MB
-
MD5
b53755b010c15f27f80bec7142571418
-
SHA1
1fe811cd9e1a85ee80ac1c86b069720eabdee5aa
-
SHA256
a140c911d441740e4f86893f5ec8f540ef068835c07469f15fb42cd0777b06ca
-
SHA512
74ec5e99e3372e1d62b5443605ca18b50e7697e1b22e893167532c81b929ff8ff4d2e66fd94474acfaf41354755904242c85fae92e293ae54643ad98abfaaf50
-
SSDEEP
196608:gEMMbJeJIC/znXw+zMgWTN/pPd/iwY1fotpsAnjFvBxYu2Zkd4id+piKocDLi9yg:gPM2LwSapPd/ICu8h5GuGat+n2
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cs2（解压我出来）\2.辅助.exe"C:\Users\Admin\AppData\Local\Temp\cs2（解压我出来）\2.辅助.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
7.1MB
-
Filesize
9.4MB
-
Filesize
4KB
-
Filesize
7.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
7.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
12.4MB
-
Filesize
9.4MB