Overview

overview

10

Static

static

10

1fdf348601...8N.exe

windows7-x64

10

1fdf348601...8N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17-12-2024 08:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1fdf3486013b6cd6727206c930e215bd4b531d321967c2a6de27a05c8972a7e8N.exe

  • Size

    366KB

  • MD5

    9b831b06df8bbac55c6f720cae4c6cd0

  • SHA1

    558834ea69e488d8890d1bb315f23a18c8a2f04a

  • SHA256

    1fdf3486013b6cd6727206c930e215bd4b531d321967c2a6de27a05c8972a7e8

  • SHA512

    e0476832a44bf6c5545921803def66366809f7087a8ceafdcf8f65ce212e3336119f919295c87cc57a6fb146d6f7a3c2d3b3b4ebbe03fdb458cd94c2c7f340c8

  • SSDEEP

    6144:BSfSHl+gv5gY1F53Aul/Egv4+E6qnwEGvIkJ7G9P1C:B2SHl+gv5gY1b5Eo4+EsEEIkJ7G9P1C

Score
10/10
blackmoonbankerdiscoverytrojan

Malware Config

Signatures

  • Blackmoon family
    blackmoon
  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon
  • Detect Blackmoon payload 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 61 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1fdf3486013b6cd6727206c930e215bd4b531d321967c2a6de27a05c8972a7e8N.exe
    "C:\Users\Admin\AppData\Local\Temp\1fdf3486013b6cd6727206c930e215bd4b531d321967c2a6de27a05c8972a7e8N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2096
    • C:\Users\Admin\AppData\Local\Temp\Syslemyqmbm.exe
      "C:\Users\Admin\AppData\Local\Temp\Syslemyqmbm.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2760

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Syslemyqmbm.exe
    Filesize

    366KB

    MD5

    68d767ffd42079f671b5736d96714e3a

    SHA1

    9a2e59dbb4f39f879802d87386cb9dabc97c1ccd

    SHA256

    1dc5cbe58b78bd6a2a75f52c2b8d097c9a7fb2fbecff67378fd3154867f6b7c0

    SHA512

    0d128c565fb556f87751b8f0cdf4fee7562fb490205cd3ef147b567025a7db4cbc27ea4ac401ac1c5299edfeda7883860a436996c9ba66a5d4337327b3c3de94

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\lpath.ini
    Filesize

    103B

    MD5

    50ba724bde71760d765e75e11a790321

    SHA1

    ced1a8ff7bbd7cce6c4c8ff637abd7bf6c910ec9

    SHA256

    684c4d7f180d15f878b8729e47525ef26bda9cfb1c7cdc8d54f82499b76cdc27

    SHA512

    d0c9ba70b5ea08cdbf8cb546b7889e2fdced7af0a16d0c1a6be89554ddfbfb83d3d1f6d3fb721229b8d885f4ae156ff41391ed534ad8742b869b5b360584cb20

    Download Submit