Analysis
-
max time kernel
119s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-12-2024 04:45
General
-
Target
c93eecc13ad4709bd99c5b8a59384e052cc92c94a2998f5c72565ebeadd07b26N.exe
-
Size
80KB
-
MD5
deef375a390b98fde9cc492efde803e0
-
SHA1
761eb455a29586dc06a6f76165a739ca97d7fd24
-
SHA256
c93eecc13ad4709bd99c5b8a59384e052cc92c94a2998f5c72565ebeadd07b26
-
SHA512
c4d5eabf6dea23b755a6d8f0bfaff7d3bb4b00c0225f9bc489aa9986c08e8e2ef3ac8addfd436583008be9bc48d6c2f4dce3acc34a8422b1fcb2bd27f8d2373c
-
SSDEEP
1536:ITJxjZZ29Up2U7O0Ov15+o46zqMi9G7WXnQQvaWh3zWKfx/t126a63m:SHZ2up5JkH+o46LuRXnLdpzp/tg6Z3m
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c93eecc13ad4709bd99c5b8a59384e052cc92c94a2998f5c72565ebeadd07b26N.exe"C:\Users\Admin\AppData\Local\Temp\c93eecc13ad4709bd99c5b8a59384e052cc92c94a2998f5c72565ebeadd07b26N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Syslemtlxlv.exe"C:\Users\Admin\AppData\Local\Temp\Syslemtlxlv.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD567c9edd984f903d7736e1b5f92affd70
SHA1f7e3d57c734689cedd0bc93d43910c4dcc7ab6b5
SHA256cf4d94754e66e105f0d15f0230d67f4e46ddd8f3bc98430c2db56f6304a64760
SHA512f593bd5c3953c79b8125213b467f6e395fe42848beab98fef79e2a149c09f7bcbdf3029820bd01dbadb6e327718ebaa25c581a1329f368970655fd430e19b15c
-
Filesize
103B
MD5f90480a66bbe3fe94bcc6215def1c26e
SHA12c806adaeb643172f512edcdca4f74a5b2b5fbbe
SHA256b2adabaf649d2e5e25b96323668ee4392842ac1425c9f98b7d84823d767ef150
SHA5129d12fcb903e513deb1e6002ce30b2028c4a4a456cfebf8a97e5085344c5df3331118c4bef52332af8bcad83ba22badb062f53829907f2107329aa1cd5b46da2c
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB