Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-12-2024 09:07
General
-
Target
5f1139849d5dc12bad8d1c3c2b7d53a9f00fdd7cb7a1113c2aa50ead70ec1ce0.exe
-
Size
80KB
-
MD5
bac35ee7440228dda7daee46a835adb0
-
SHA1
12ede66acfa70fd90dbebf6c6490b5ff5acac4d3
-
SHA256
5f1139849d5dc12bad8d1c3c2b7d53a9f00fdd7cb7a1113c2aa50ead70ec1ce0
-
SHA512
25c2b80198940e8b5002a1b3308338a9b56090c56a610982a3299fecfa7af23f030c68a6dfa8769b2924ecf7d047dfb92a6953534a943ea45af5b9148e4b44a1
-
SSDEEP
1536:ITJxjZZ29Up2U7O0Ov15+o46zqMi9G7WXnQQvaWh3zWKfx/t126a63m:SHZ2up5JkH+o46LuRXnLdpzp/tg6Z3m
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 61 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f1139849d5dc12bad8d1c3c2b7d53a9f00fdd7cb7a1113c2aa50ead70ec1ce0.exe"C:\Users\Admin\AppData\Local\Temp\5f1139849d5dc12bad8d1c3c2b7d53a9f00fdd7cb7a1113c2aa50ead70ec1ce0.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Syslemqiykg.exe"C:\Users\Admin\AppData\Local\Temp\Syslemqiykg.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
102B
MD5b4057d78af0ad184122084729a71452a
SHA1542f6310c6f3d78670c86cfbc1e3858185499b5f
SHA256c57ff6837e355c73f036fb2f4c22ffb7db8c43d139de43612bb2cc3cdf05dfc6
SHA5125877c67521ef9a532680996a5c418dfdb854a45a5e41dbc143070eb1c1011699183e618433656d27ae73adfb3ba0dec777ae7090a16189109162275372ac89d7
-
Filesize
80KB
MD5b2d3ecf5b6970cd4569f84f2403ef7d3
SHA132a274545e5fc92d898bfe2d2f9dbf17af560b7d
SHA256df9c93ec8fca8d3e415061f0eff23bd634402ecedf944ee92f0b3207c92bb75b
SHA512f0797f8d373b41c3bbeba261f8b3a9da5db7f7970899a22d5c6eb87aca467cbe311d5281a6204301692fd5cae640ef0480ed9fd95eeefa80eac67e3c02faf09c
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB