Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
24-11-2024 19:54
General
-
Target
547977278e0c0c5a31a92ad52b7b91859510c07ca03b491c7d87987b00a4a5dfN.exe
-
Size
74KB
-
MD5
3652049bc61958cb7c6d4e90fa456a50
-
SHA1
5f121650fa17ca9746ec57c41f0d77188dccdacc
-
SHA256
547977278e0c0c5a31a92ad52b7b91859510c07ca03b491c7d87987b00a4a5df
-
SHA512
9bd88752b3da18cfc5033ff6e9a947498f67ac5427ce61ea459e7326eb1ec10ca7c8662d1fb893efa6b354511590657f5b6ea38136f456ee2cd8547238035777
-
SSDEEP
1536:IyfIcT9U1tPrgQvhLopacl1TsQk0NJP/PAjgas/3VUN0YWZPnouy8/:VfIS2vhLoz5sQkqgjg1YWZfout/
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 61 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\547977278e0c0c5a31a92ad52b7b91859510c07ca03b491c7d87987b00a4a5dfN.exe"C:\Users\Admin\AppData\Local\Temp\547977278e0c0c5a31a92ad52b7b91859510c07ca03b491c7d87987b00a4a5dfN.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Syslemvwxln.exe"C:\Users\Admin\AppData\Local\Temp\Syslemvwxln.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
103B
MD54cacf1c9abe14d2fbba830f7fd869702
SHA1b7539a9543f85493ea3320b7fbb05450bc6ada8b
SHA2562242996cc12ada933f307e74217ee9774134e2dd3d34bf0d2d66e0ac52f0faa3
SHA5128526ee7691e543f5f85813caf471dec5f1adc7440701304193ed6472b65d5acebeddd1791950ae221dfbb131245e21a5431a89ae2ffafd875beb2baff275c090
-
Filesize
74KB
MD5eea61afd8a8a4f7d44724a15dd2abe5a
SHA15c82a430fb3bc4d12ef4ef7e1a15638ba7b97425
SHA256124f80fe417d8135dff17d536f1ddf6ef30299aeda1f7a1cb48c6fd82ea53ebb
SHA5128ed1eed762fd2cf8da78d3d77009335d404bd1d657e9a84f6850687c6cd7fe0df4328dfed3ca77ac33d51c32a44089b28d0d8d4ac4a2d30e18866bbe59589fb6
-
Filesize
444KB
-
Filesize
444KB
-
Filesize
444KB
-
Filesize
444KB