Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-12-2024 18:18
General
-
Target
d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
-
Size
9.9MB
-
MD5
b179d566336497bab9953d3f7880339f
-
SHA1
28e8bef327f0de400e6396940683eb9c550a86de
-
SHA256
d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8
-
SHA512
24d47e2e1fecf76205268b3d3b1faf0f7362603f7f30588de02341a4bfa0dacf7196d7f70106cd89f611ba8a09f1cbf2bda06756f0575768a377f5c5aee514db
-
SSDEEP
196608:10/mSRYtxyL/iNKxGUGKkCAEHGzEK0dyB5aDb/PlxpZW:iOMYHuuKoUGKYEHmEldyB5aPfpZW
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 10 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe"C:\Users\Admin\AppData\Local\Temp\d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\½£Ä§°Ë»ÄV999\14360d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exeC:\½£Ä§°Ë»ÄV999\14360d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD578f64e50c77f37cc3f9da67cb7c550ec
SHA16587a18e250d196019e187392f6b989591e7f0be
SHA256c87c8179a8640232b300fb605b9570cbeb631ae2778525abad72bce4a9bb7e27
SHA5120c82ca36862f95bc42a8f214c3ae4caf54073cea4f6903003e93c73671d6321435ea3ab9a12f07da03d20edb4a7abf62e74d158d5e43ca0abab9be856fd8056b
-
Filesize
9.9MB
MD5b179d566336497bab9953d3f7880339f
SHA128e8bef327f0de400e6396940683eb9c550a86de
SHA256d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8
SHA51224d47e2e1fecf76205268b3d3b1faf0f7362603f7f30588de02341a4bfa0dacf7196d7f70106cd89f611ba8a09f1cbf2bda06756f0575768a377f5c5aee514db
-
Filesize
6.0MB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
4KB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB