Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-12-2024 20:14
General
-
Target
cc63a8d887d228cc029b25cd99efc577b05b38da0fd8a4f7e43ef6c6f2a4f03c.exe
-
Size
9.5MB
-
MD5
23b242a8fbb89af6f7c636e04d2bbd8c
-
SHA1
111b4bf14ea316484ec6cdedd389ea421a696355
-
SHA256
cc63a8d887d228cc029b25cd99efc577b05b38da0fd8a4f7e43ef6c6f2a4f03c
-
SHA512
8f57404aebf7d31179078d354dff7e0db58b2ad2e0054f1caafef91dfce83877e8c051affecae267a44518cc558642080aef3c28d84dbd133a0ad7dfac9b6c20
-
SSDEEP
196608:10/mSdYvk/YoINOfjgQHwQbz/wA1bEGSFwCkYWI9whTufOXv7:iOBvkZ3fj9rzoA1bbUwWTKTuoj
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc63a8d887d228cc029b25cd99efc577b05b38da0fd8a4f7e43ef6c6f2a4f03c.exe"C:\Users\Admin\AppData\Local\Temp\cc63a8d887d228cc029b25cd99efc577b05b38da0fd8a4f7e43ef6c6f2a4f03c.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Áú»ê»ðÁú΢¶Ë\31614cc63a8d887d228cc029b25cd99efc577b05b38da0fd8a4f7e43ef6c6f2a4f03c.exeC:\Áú»ê»ðÁú΢¶Ë\31614cc63a8d887d228cc029b25cd99efc577b05b38da0fd8a4f7e43ef6c6f2a4f03c.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD52fe5c963e7f6fd90dcfbf286dc9bb4f1
SHA1980bfab324014caeccbf0c855fed7a8d5042dbc5
SHA25687344e101c2f7d4d59a396615bba322ea2b00b462d28795065fbf28db3098809
SHA5122e13ed152ceae1f2c33f203045e56d3d99f534ae7769eb658edf77469eb538c7dbabbc3157c2126c05a9411333745068395d3fd6087102e5a89f8df40082074b
-
Filesize
9.5MB
MD523b242a8fbb89af6f7c636e04d2bbd8c
SHA1111b4bf14ea316484ec6cdedd389ea421a696355
SHA256cc63a8d887d228cc029b25cd99efc577b05b38da0fd8a4f7e43ef6c6f2a4f03c
SHA5128f57404aebf7d31179078d354dff7e0db58b2ad2e0054f1caafef91dfce83877e8c051affecae267a44518cc558642080aef3c28d84dbd133a0ad7dfac9b6c20
-
Filesize
6.0MB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.0MB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
6.0MB