Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
20-12-2024 12:46
General
-
Target
b6d4e16160d0e3aa3a9d9e8985dcb8a5ef9c024fa6bfd4302f713975a675c2d8.exe
-
Size
6.3MB
-
MD5
352307e76b45f1134fdbbef7bfce9749
-
SHA1
f0419ea56b53ef5eae113c3de9502d5170ffce24
-
SHA256
b6d4e16160d0e3aa3a9d9e8985dcb8a5ef9c024fa6bfd4302f713975a675c2d8
-
SHA512
6b0f5ce0035ffe9a592d4888dcd4751f523c3216359f9b343c026f5457a40dcf5741a06c5aa19e5b0c0b0edb0bf81d2b7e9cc474280a25051abb1d95e6419fbf
-
SSDEEP
196608:upkWINA4fVRH1fYZfc4U+EoeUs51U8ZmNy:u8dftfYZfcLICU8ZmNy
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 3 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6d4e16160d0e3aa3a9d9e8985dcb8a5ef9c024fa6bfd4302f713975a675c2d8.exe"C:\Users\Admin\AppData\Local\Temp\b6d4e16160d0e3aa3a9d9e8985dcb8a5ef9c024fa6bfd4302f713975a675c2d8.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.8MB
MD56facf113816011f261ff3f8632ca1ce6
SHA1d57b215c507a071b683922e3c7c02ed6a7b9f815
SHA2564d0f680f4e3138c2bf5907cf18ab504378c440e8038d0a5bc47e1d4c6aedb154
SHA51293c8b77e8170d3579e9b7e460b421e783bd57ddf56aaed7e050f851972699fb580fac8e9ab17a4ae3dc0aed7fc02e50649cad187959d5c03198c208807db4cb4
-
Filesize
140KB
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
140KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
140KB
-
Filesize
1.1MB