Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-12-2024 07:01
General
-
Target
8eb5824e39b9cfea66be9c53577ef503c902b539134e139c5f2115afcae01acb.exe
-
Size
453KB
-
MD5
46415c86eca42713aea3dd7af18ac01c
-
SHA1
aebd7129f3467ce63fcf77596e52cc866f67e47c
-
SHA256
8eb5824e39b9cfea66be9c53577ef503c902b539134e139c5f2115afcae01acb
-
SHA512
790c779140fa5055564c3435b667114315b0383ffd3034d1b0d46bec462caca6a2747d7c608007b22d1dc81705c096fb85ef8673ce265275df3774422b0a22d1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
Score
10/10
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 38 IoCs
-
Executes dropped EXE 64 IoCs
-
UPX packed file 47 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8eb5824e39b9cfea66be9c53577ef503c902b539134e139c5f2115afcae01acb.exe"C:\Users\Admin\AppData\Local\Temp\8eb5824e39b9cfea66be9c53577ef503c902b539134e139c5f2115afcae01acb.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\xrxxrxl.exec:\xrxxrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdvdj.exec:\jdvdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffxfrrl.exec:\ffxfrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhhth.exec:\hbhhth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rflxlrx.exec:\rflxlrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhttbb.exec:\nhttbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5dppj.exec:\5dppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9xxrfrx.exec:\9xxrfrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnbtbh.exec:\hnbtbh.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\3xrlxfr.exec:\3xrlxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbhtt.exec:\nhbhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5vjjp.exec:\5vjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frllxxf.exec:\frllxxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tthhnt.exec:\tthhnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvvdp.exec:\vvvdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5fffrxf.exec:\5fffrxf.exe17⤵
- Executes dropped EXE
-
\??\c:\ddpjv.exec:\ddpjv.exe18⤵
- Executes dropped EXE
-
\??\c:\dvjvj.exec:\dvjvj.exe19⤵
- Executes dropped EXE
-
\??\c:\3thhtb.exec:\3thhtb.exe20⤵
- Executes dropped EXE
-
\??\c:\vjjvp.exec:\vjjvp.exe21⤵
- Executes dropped EXE
-
\??\c:\rrxrfff.exec:\rrxrfff.exe22⤵
- Executes dropped EXE
-
\??\c:\nbnthn.exec:\nbnthn.exe23⤵
- Executes dropped EXE
-
\??\c:\ffrrxfl.exec:\ffrrxfl.exe24⤵
- Executes dropped EXE
-
\??\c:\3frfxfx.exec:\3frfxfx.exe25⤵
- Executes dropped EXE
-
\??\c:\vpddj.exec:\vpddj.exe26⤵
- Executes dropped EXE
-
\??\c:\xxflrrf.exec:\xxflrrf.exe27⤵
- Executes dropped EXE
-
\??\c:\vpjpv.exec:\vpjpv.exe28⤵
- Executes dropped EXE
-
\??\c:\5fxfrxl.exec:\5fxfrxl.exe29⤵
- Executes dropped EXE
-
\??\c:\vpppd.exec:\vpppd.exe30⤵
- Executes dropped EXE
-
\??\c:\lxxxxlx.exec:\lxxxxlx.exe31⤵
- Executes dropped EXE
-
\??\c:\nhttnn.exec:\nhttnn.exe32⤵
- Executes dropped EXE
-
\??\c:\vvpvp.exec:\vvpvp.exe33⤵
- Executes dropped EXE
-
\??\c:\3bthtb.exec:\3bthtb.exe34⤵
- Executes dropped EXE
-
\??\c:\pvppp.exec:\pvppp.exe35⤵
- Executes dropped EXE
-
\??\c:\frfflrf.exec:\frfflrf.exe36⤵
- Executes dropped EXE
-
\??\c:\hhbhtb.exec:\hhbhtb.exe37⤵
- Executes dropped EXE
-
\??\c:\bnhbhh.exec:\bnhbhh.exe38⤵
- Executes dropped EXE
-
\??\c:\djdjv.exec:\djdjv.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\1lrlrff.exec:\1lrlrff.exe40⤵
- Executes dropped EXE
-
\??\c:\hbthnn.exec:\hbthnn.exe41⤵
- Executes dropped EXE
-
\??\c:\dvvdp.exec:\dvvdp.exe42⤵
- Executes dropped EXE
-
\??\c:\3xxlxll.exec:\3xxlxll.exe43⤵
- Executes dropped EXE
-
\??\c:\bthnnt.exec:\bthnnt.exe44⤵
- Executes dropped EXE
-
\??\c:\thttbb.exec:\thttbb.exe45⤵
- Executes dropped EXE
-
\??\c:\dvjpv.exec:\dvjpv.exe46⤵
- Executes dropped EXE
-
\??\c:\9xxxllr.exec:\9xxxllr.exe47⤵
- Executes dropped EXE
-
\??\c:\nbhbtt.exec:\nbhbtt.exe48⤵
- Executes dropped EXE
-
\??\c:\tbbnbb.exec:\tbbnbb.exe49⤵
- Executes dropped EXE
-
\??\c:\dddjd.exec:\dddjd.exe50⤵
- Executes dropped EXE
-
\??\c:\rrlrrxf.exec:\rrlrrxf.exe51⤵
- Executes dropped EXE
-
\??\c:\7flllrf.exec:\7flllrf.exe52⤵
- Executes dropped EXE
-
\??\c:\nhhnnt.exec:\nhhnnt.exe53⤵
- Executes dropped EXE
-
\??\c:\jdvpv.exec:\jdvpv.exe54⤵
- Executes dropped EXE
-
\??\c:\jpppv.exec:\jpppv.exe55⤵
- Executes dropped EXE
-
\??\c:\xxlrxfl.exec:\xxlrxfl.exe56⤵
- Executes dropped EXE
-
\??\c:\llflxlr.exec:\llflxlr.exe57⤵
- Executes dropped EXE
-
\??\c:\bbnhhh.exec:\bbnhhh.exe58⤵
- Executes dropped EXE
-
\??\c:\pjdjv.exec:\pjdjv.exe59⤵
- Executes dropped EXE
-
\??\c:\xxxlrxr.exec:\xxxlrxr.exe60⤵
- Executes dropped EXE
-
\??\c:\3nnbhn.exec:\3nnbhn.exe61⤵
- Executes dropped EXE
-
\??\c:\thbnbn.exec:\thbnbn.exe62⤵
- Executes dropped EXE
-
\??\c:\ddjpp.exec:\ddjpp.exe63⤵
- Executes dropped EXE
-
\??\c:\9lrlxlf.exec:\9lrlxlf.exe64⤵
- Executes dropped EXE
-
\??\c:\lllrxxr.exec:\lllrxxr.exe65⤵
- Executes dropped EXE
-
\??\c:\ntnnbb.exec:\ntnnbb.exe66⤵
-
\??\c:\jjdpv.exec:\jjdpv.exe67⤵
-
\??\c:\3xrflrr.exec:\3xrflrr.exe68⤵
-
\??\c:\xxxxlrf.exec:\xxxxlrf.exe69⤵
-
\??\c:\nbnnth.exec:\nbnnth.exe70⤵
-
\??\c:\jpppd.exec:\jpppd.exe71⤵
-
\??\c:\ppjjp.exec:\ppjjp.exe72⤵
-
\??\c:\3xfrlrf.exec:\3xfrlrf.exe73⤵
-
\??\c:\hbhntb.exec:\hbhntb.exe74⤵
-
\??\c:\dvjdv.exec:\dvjdv.exe75⤵
-
\??\c:\jdvjp.exec:\jdvjp.exe76⤵
-
\??\c:\fxlffxx.exec:\fxlffxx.exe77⤵
-
\??\c:\nhbntb.exec:\nhbntb.exe78⤵
-
\??\c:\3dvpd.exec:\3dvpd.exe79⤵
-
\??\c:\vdjpd.exec:\vdjpd.exe80⤵
-
\??\c:\rlfflrx.exec:\rlfflrx.exe81⤵
-
\??\c:\tbnthh.exec:\tbnthh.exe82⤵
-
\??\c:\nbtthb.exec:\nbtthb.exe83⤵
-
\??\c:\dpjjp.exec:\dpjjp.exe84⤵
-
\??\c:\xlflffx.exec:\xlflffx.exe85⤵
-
\??\c:\lfrfrxx.exec:\lfrfrxx.exe86⤵
-
\??\c:\hbhnbt.exec:\hbhnbt.exe87⤵
-
\??\c:\3dpvv.exec:\3dpvv.exe88⤵
-
\??\c:\vpjjp.exec:\vpjjp.exe89⤵
-
\??\c:\fxlfllx.exec:\fxlfllx.exe90⤵
-
\??\c:\1bnbhn.exec:\1bnbhn.exe91⤵
-
\??\c:\thtbhb.exec:\thtbhb.exe92⤵
-
\??\c:\pjddv.exec:\pjddv.exe93⤵
-
\??\c:\rfrxxfx.exec:\rfrxxfx.exe94⤵
-
\??\c:\rlxfllr.exec:\rlxfllr.exe95⤵
-
\??\c:\tttbhn.exec:\tttbhn.exe96⤵
-
\??\c:\dpjjp.exec:\dpjjp.exe97⤵
-
\??\c:\5xffllr.exec:\5xffllr.exe98⤵
-
\??\c:\3lfrxxx.exec:\3lfrxxx.exe99⤵
-
\??\c:\5bbtbn.exec:\5bbtbn.exe100⤵
-
\??\c:\7jddj.exec:\7jddj.exe101⤵
-
\??\c:\jdvdp.exec:\jdvdp.exe102⤵
-
\??\c:\xxrfxfx.exec:\xxrfxfx.exe103⤵
-
\??\c:\fxrxlll.exec:\fxrxlll.exe104⤵
-
\??\c:\1nhttb.exec:\1nhttb.exe105⤵
-
\??\c:\7jvvv.exec:\7jvvv.exe106⤵
-
\??\c:\frffflr.exec:\frffflr.exe107⤵
-
\??\c:\xrlllxl.exec:\xrlllxl.exe108⤵
-
\??\c:\3bnntt.exec:\3bnntt.exe109⤵
-
\??\c:\5vjdj.exec:\5vjdj.exe110⤵
-
\??\c:\lfllxxx.exec:\lfllxxx.exe111⤵
-
\??\c:\rlflxfl.exec:\rlflxfl.exe112⤵
-
\??\c:\5nhnnn.exec:\5nhnnn.exe113⤵
-
\??\c:\vjppv.exec:\vjppv.exe114⤵
-
\??\c:\5dppd.exec:\5dppd.exe115⤵
-
\??\c:\xrrxllf.exec:\xrrxllf.exe116⤵
-
\??\c:\nnbnbb.exec:\nnbnbb.exe117⤵
-
\??\c:\thbbhh.exec:\thbbhh.exe118⤵
-
\??\c:\djpjp.exec:\djpjp.exe119⤵
-
\??\c:\djdjp.exec:\djdjp.exe120⤵
- System Location Discovery: System Language Discovery
-
\??\c:\xrrrxxx.exec:\xrrrxxx.exe121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-