Analysis
-
max time kernel
119s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
26/11/2024, 01:03
General
-
Target
2a03d87477d5c0a2f84538779b4b6c860067fc0276fe8a810807d8177931bd1fN.exe
-
Size
86KB
-
MD5
49786adf48758c538b278c55bed45a40
-
SHA1
b8c2fdae1b543ee444de88e97fc9ef6b0b9183f5
-
SHA256
2a03d87477d5c0a2f84538779b4b6c860067fc0276fe8a810807d8177931bd1f
-
SHA512
41fa7b18ac05838ea7a7a2885eafadaa09c7087e83fb151479332cb4cbcbeed692706bcb4983389c2b5b4a3d745d15dc5a1dddb877e5ffbe1439d77b8cc7a101
-
SSDEEP
1536:/s2OpUqBA6pkuTHQ0cIrf+7LYsF03RYSYhM9l8yDI15XygDdDv:/ImRWTTpc627LXFm6+9l8nygDdD
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 1 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 59 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a03d87477d5c0a2f84538779b4b6c860067fc0276fe8a810807d8177931bd1fN.exe"C:\Users\Admin\AppData\Local\Temp\2a03d87477d5c0a2f84538779b4b6c860067fc0276fe8a810807d8177931bd1fN.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Systemhusfz.exe"C:\Users\Admin\AppData\Local\Temp\Systemhusfz.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
103B
MD57d51001c47b5656f0acf57234dd39fde
SHA1e037c76a50a87a98b85946db7249afa749b3c104
SHA256f4bc8ac13f5882c0c4577e51d8d8791c4c597f45309b51e10e5d560361f0f6de
SHA51292cc40faf1cc720f413bf020881035e080c36821c1088f5759a83aca5a47c794a547a8b718264245432098dd1d012502a01299fc1ded59668b58d9b26ef10bc4
-
Filesize
86KB
MD5573e236c9159c09102885da4932df637
SHA123abda93a5e2e8902119f7a3989ba8d3afbe2d03
SHA256b24ce1dfc4fe7078a83a01f22430eaf09e8a46f12095de235f715b25c5e8ea18
SHA5127f8bab1724db206a1dd7371006c4c5f82d148d826d8fd288436a0fd7e8ac70acd0892276db27c0440676b4bde8b2b30169d331ccd7641e750672a058ae394870
-
Filesize
416KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB