Analysis
-
max time kernel
119s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17-12-2024 09:07
General
-
Target
5f1139849d5dc12bad8d1c3c2b7d53a9f00fdd7cb7a1113c2aa50ead70ec1ce0.exe
-
Size
80KB
-
MD5
bac35ee7440228dda7daee46a835adb0
-
SHA1
12ede66acfa70fd90dbebf6c6490b5ff5acac4d3
-
SHA256
5f1139849d5dc12bad8d1c3c2b7d53a9f00fdd7cb7a1113c2aa50ead70ec1ce0
-
SHA512
25c2b80198940e8b5002a1b3308338a9b56090c56a610982a3299fecfa7af23f030c68a6dfa8769b2924ecf7d047dfb92a6953534a943ea45af5b9148e4b44a1
-
SSDEEP
1536:ITJxjZZ29Up2U7O0Ov15+o46zqMi9G7WXnQQvaWh3zWKfx/t126a63m:SHZ2up5JkH+o46LuRXnLdpzp/tg6Z3m
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f1139849d5dc12bad8d1c3c2b7d53a9f00fdd7cb7a1113c2aa50ead70ec1ce0.exe"C:\Users\Admin\AppData\Local\Temp\5f1139849d5dc12bad8d1c3c2b7d53a9f00fdd7cb7a1113c2aa50ead70ec1ce0.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Syslemijiru.exe"C:\Users\Admin\AppData\Local\Temp\Syslemijiru.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD586bb62aa7b4cf5b526c50d1d0b1ced2f
SHA127b95ef7f3900c03531553a0b77df2872dd4d1d0
SHA2568fb10935b040f4938c37a6dfed3159502e9a743d87f9f388ace19ed05ffd7174
SHA512240df564714c01b85e4ca053ad7f1c3d3de5d1e9464c5a555e6f3363696946563ec2da7742db3293e73c8110ae15d98b62db66f9ada2f7d69fdbc76f8efc5d0f
-
Filesize
102B
MD5b4057d78af0ad184122084729a71452a
SHA1542f6310c6f3d78670c86cfbc1e3858185499b5f
SHA256c57ff6837e355c73f036fb2f4c22ffb7db8c43d139de43612bb2cc3cdf05dfc6
SHA5125877c67521ef9a532680996a5c418dfdb854a45a5e41dbc143070eb1c1011699183e618433656d27ae73adfb3ba0dec777ae7090a16189109162275372ac89d7
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB