Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17/12/2024, 21:36
General
-
Target
562f3946eec5bd665777fa1f95df701859ae3f94b747439c5b66ddd480c2b62d.exe
-
Size
80KB
-
MD5
2108c501ee09814f34e1038b5766c96b
-
SHA1
3e8e07ee1d4993582078d555c1dd840e5a869f18
-
SHA256
562f3946eec5bd665777fa1f95df701859ae3f94b747439c5b66ddd480c2b62d
-
SHA512
571cbfe59a5dac6b59aebfae01d9ea4652204cc1d17cfd714bf4972b3068e7cfa99d414df30b471dc52a9bfc1e29f10866c6ee6cd3484344ff8d855b2116aa90
-
SSDEEP
1536:ITJxjZZ29Up2U7O0Ov15+o46zqMi9G7WXnQQvaWh3zWKfx/t126a63E:SHZ2up5JkH+o46LuRXnLdpzp/tg6Z3E
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\562f3946eec5bd665777fa1f95df701859ae3f94b747439c5b66ddd480c2b62d.exe"C:\Users\Admin\AppData\Local\Temp\562f3946eec5bd665777fa1f95df701859ae3f94b747439c5b66ddd480c2b62d.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Syslemnszko.exe"C:\Users\Admin\AppData\Local\Temp\Syslemnszko.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD518977837d705874d8cd308001662a450
SHA162ecfd85c3de92bf659f084b5b3bbea5438063e5
SHA2560de9e7e1593d750f0ab63a527ed16a622d8c03d072ae85379355a3a570f13204
SHA5127af60da84b2d72a599a2d6f5472ea175ce58c06c279f8e006067b2ec6517c94c17379f99c3de3b0832fb1044be9a732a81e2b85439c781d27fbdaafd1e0b5468
-
Filesize
102B
MD5d7ff81d9fbc0fdb7447f016aefe7e42d
SHA1aa8cab914b5c0ea9a0f545d1b8af8f0ce39e33a1
SHA25685da4e2ba347a0d9eaa7f75e3536bc2a065361f02cec9fd077127857c4867cc1
SHA512b0edcf998029b3e16661f0ea20959c15d6a839229fa1517e0053e5ca14110d716ecc00d7923110cd0927964afae5edad5bf940dc42dd9cd5537820180a075bdc
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB