Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-11-2024 07:19
General
-
Target
F2.exe
-
Size
705KB
-
MD5
0391f771ba020e5bd11fa364da3a4fd5
-
SHA1
0329377a53f3942ae1012a2053db8d0b4b785a66
-
SHA256
7b5b46b4477701ee884adc1a39cd4c556fa45e097426026ed5338c35cdf6bc26
-
SHA512
d1e35995ac008be8daed0f6d8fa21c1f36be70c6992958299f5372beb26b4d4ba862a83b9bdb814ec25e43a3832a9a68d85a2b7e7c3d698da2ce4496e048aadd
-
SSDEEP
12288:5z4UfgS9ru58bxjyD0t71c6YXXxXadGPFiGQrhAiVdJItpM7+59MdOOoS:dhCC24tTYBeakGQNTV7OR5S
Score
10/10
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\F2.exe"C:\Users\Admin\AppData\Local\Temp\F2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
-
Filesize
2.9MB