Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
22/12/2024, 05:31
General
-
Target
c4260fb2a49485c8cfda8980a4f6c66d5a0b7e722a6382dc1650facb3f9f9b47.exe
-
Size
83KB
-
MD5
543c7f7d1487155127f9cb6d98fb04d8
-
SHA1
66886af8238289b6ae961059b098368fc223dce1
-
SHA256
c4260fb2a49485c8cfda8980a4f6c66d5a0b7e722a6382dc1650facb3f9f9b47
-
SHA512
0afe03166403d4ab6b42d622b56f11e598adfb4fb43138ac54aa893025952481cc41e67e44d3a265895a93f7de9518477c4bab73aab9022f1efb491b27fe5e77
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89Q7:ymb3NkkiQ3mdBjFIIp9L9QrrA8k
Score
10/10
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 22 IoCs
-
Executes dropped EXE 64 IoCs
-
UPX packed file 30 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4260fb2a49485c8cfda8980a4f6c66d5a0b7e722a6382dc1650facb3f9f9b47.exe"C:\Users\Admin\AppData\Local\Temp\c4260fb2a49485c8cfda8980a4f6c66d5a0b7e722a6382dc1650facb3f9f9b47.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\xfrxxlx.exec:\xfrxxlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9bbthh.exec:\9bbthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnbtbb.exec:\nnbtbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlxxlfr.exec:\rlxxlfr.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\9nhnnt.exec:\9nhnnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llxxflx.exec:\llxxflx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxlrllr.exec:\xxlrllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdppd.exec:\vdppd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddpvj.exec:\ddpvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbntht.exec:\hbntht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1tnntb.exec:\1tnntb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvjpv.exec:\dvjpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrxlflr.exec:\lrxlflr.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\nnthtb.exec:\nnthtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhthtb.exec:\bhthtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3pdjv.exec:\3pdjv.exe17⤵
- Executes dropped EXE
-
\??\c:\xxflflx.exec:\xxflflx.exe18⤵
- Executes dropped EXE
-
\??\c:\hhtbnb.exec:\hhtbnb.exe19⤵
- Executes dropped EXE
-
\??\c:\hhthtb.exec:\hhthtb.exe20⤵
- Executes dropped EXE
-
\??\c:\dddjd.exec:\dddjd.exe21⤵
- Executes dropped EXE
-
\??\c:\jppjv.exec:\jppjv.exe22⤵
- Executes dropped EXE
-
\??\c:\ffxxlxl.exec:\ffxxlxl.exe23⤵
- Executes dropped EXE
-
\??\c:\1btnnh.exec:\1btnnh.exe24⤵
- Executes dropped EXE
-
\??\c:\9vddp.exec:\9vddp.exe25⤵
- Executes dropped EXE
-
\??\c:\jpdvj.exec:\jpdvj.exe26⤵
- Executes dropped EXE
-
\??\c:\1xlrxxf.exec:\1xlrxxf.exe27⤵
- Executes dropped EXE
-
\??\c:\rrfrffl.exec:\rrfrffl.exe28⤵
- Executes dropped EXE
-
\??\c:\3vvvd.exec:\3vvvd.exe29⤵
- Executes dropped EXE
-
\??\c:\vvjjv.exec:\vvjjv.exe30⤵
- Executes dropped EXE
-
\??\c:\7frrflr.exec:\7frrflr.exe31⤵
- Executes dropped EXE
-
\??\c:\bbhnhn.exec:\bbhnhn.exe32⤵
- Executes dropped EXE
-
\??\c:\5bntth.exec:\5bntth.exe33⤵
- Executes dropped EXE
-
\??\c:\jpvdv.exec:\jpvdv.exe34⤵
- Executes dropped EXE
-
\??\c:\vvdjp.exec:\vvdjp.exe35⤵
- Executes dropped EXE
-
\??\c:\5lflxlr.exec:\5lflxlr.exe36⤵
- Executes dropped EXE
-
\??\c:\3fxxlrf.exec:\3fxxlrf.exe37⤵
- Executes dropped EXE
-
\??\c:\nthntb.exec:\nthntb.exe38⤵
- Executes dropped EXE
-
\??\c:\9jddj.exec:\9jddj.exe39⤵
- Executes dropped EXE
-
\??\c:\pdpdp.exec:\pdpdp.exe40⤵
- Executes dropped EXE
-
\??\c:\5rrrfrf.exec:\5rrrfrf.exe41⤵
- Executes dropped EXE
-
\??\c:\lrrxllr.exec:\lrrxllr.exe42⤵
- Executes dropped EXE
-
\??\c:\7tntht.exec:\7tntht.exe43⤵
- Executes dropped EXE
-
\??\c:\hntbnb.exec:\hntbnb.exe44⤵
- Executes dropped EXE
-
\??\c:\ppvjd.exec:\ppvjd.exe45⤵
- Executes dropped EXE
-
\??\c:\jpjpj.exec:\jpjpj.exe46⤵
- Executes dropped EXE
-
\??\c:\7xlrrfr.exec:\7xlrrfr.exe47⤵
- Executes dropped EXE
-
\??\c:\5xlxlrx.exec:\5xlxlrx.exe48⤵
- Executes dropped EXE
-
\??\c:\ntnbtn.exec:\ntnbtn.exe49⤵
- Executes dropped EXE
-
\??\c:\tthbnb.exec:\tthbnb.exe50⤵
- Executes dropped EXE
-
\??\c:\pjdjd.exec:\pjdjd.exe51⤵
- Executes dropped EXE
-
\??\c:\lfrrfxx.exec:\lfrrfxx.exe52⤵
- Executes dropped EXE
-
\??\c:\bhhtnt.exec:\bhhtnt.exe53⤵
- Executes dropped EXE
-
\??\c:\jpdpv.exec:\jpdpv.exe54⤵
- Executes dropped EXE
-
\??\c:\jpjjv.exec:\jpjjv.exe55⤵
- Executes dropped EXE
-
\??\c:\xxffrxl.exec:\xxffrxl.exe56⤵
- Executes dropped EXE
-
\??\c:\nhtbhb.exec:\nhtbhb.exe57⤵
- Executes dropped EXE
-
\??\c:\1bbhth.exec:\1bbhth.exe58⤵
- Executes dropped EXE
-
\??\c:\pvjjj.exec:\pvjjj.exe59⤵
- Executes dropped EXE
-
\??\c:\vvjjp.exec:\vvjjp.exe60⤵
- Executes dropped EXE
-
\??\c:\llfllrf.exec:\llfllrf.exe61⤵
- Executes dropped EXE
-
\??\c:\3fllxxf.exec:\3fllxxf.exe62⤵
- Executes dropped EXE
-
\??\c:\bhnbbh.exec:\bhnbbh.exe63⤵
- Executes dropped EXE
-
\??\c:\nhntbb.exec:\nhntbb.exe64⤵
- Executes dropped EXE
-
\??\c:\jjpjp.exec:\jjpjp.exe65⤵
- Executes dropped EXE
-
\??\c:\xrlxxll.exec:\xrlxxll.exe66⤵
-
\??\c:\rrxxffr.exec:\rrxxffr.exe67⤵
-
\??\c:\hnthht.exec:\hnthht.exe68⤵
-
\??\c:\hbnntn.exec:\hbnntn.exe69⤵
-
\??\c:\9dvdd.exec:\9dvdd.exe70⤵
-
\??\c:\vvpvd.exec:\vvpvd.exe71⤵
-
\??\c:\rffrrrr.exec:\rffrrrr.exe72⤵
-
\??\c:\3lrrxxf.exec:\3lrrxxf.exe73⤵
-
\??\c:\1nnbbh.exec:\1nnbbh.exe74⤵
-
\??\c:\bttbnt.exec:\bttbnt.exe75⤵
-
\??\c:\dvvdd.exec:\dvvdd.exe76⤵
-
\??\c:\frxrflx.exec:\frxrflx.exe77⤵
-
\??\c:\fxffxfl.exec:\fxffxfl.exe78⤵
-
\??\c:\flfrfrf.exec:\flfrfrf.exe79⤵
-
\??\c:\5tnnnn.exec:\5tnnnn.exe80⤵
-
\??\c:\tbbntb.exec:\tbbntb.exe81⤵
-
\??\c:\pjppd.exec:\pjppd.exe82⤵
-
\??\c:\fllxfrr.exec:\fllxfrr.exe83⤵
-
\??\c:\lrflfff.exec:\lrflfff.exe84⤵
-
\??\c:\9bbtnb.exec:\9bbtnb.exe85⤵
-
\??\c:\3thnbh.exec:\3thnbh.exe86⤵
-
\??\c:\jppvj.exec:\jppvj.exe87⤵
-
\??\c:\jjpvd.exec:\jjpvd.exe88⤵
-
\??\c:\flrrllx.exec:\flrrllx.exe89⤵
-
\??\c:\rlrflrf.exec:\rlrflrf.exe90⤵
-
\??\c:\1tbhth.exec:\1tbhth.exe91⤵
-
\??\c:\hhtbhh.exec:\hhtbhh.exe92⤵
-
\??\c:\9pvjv.exec:\9pvjv.exe93⤵
-
\??\c:\fxlrlxx.exec:\fxlrlxx.exe94⤵
-
\??\c:\lrffrxx.exec:\lrffrxx.exe95⤵
-
\??\c:\9xllrxx.exec:\9xllrxx.exe96⤵
-
\??\c:\hbntbh.exec:\hbntbh.exe97⤵
-
\??\c:\5bnnbb.exec:\5bnnbb.exe98⤵
-
\??\c:\7ppdd.exec:\7ppdd.exe99⤵
-
\??\c:\dvvpp.exec:\dvvpp.exe100⤵
-
\??\c:\1rrrrxf.exec:\1rrrrxf.exe101⤵
-
\??\c:\bttbhn.exec:\bttbhn.exe102⤵
-
\??\c:\hbnnbt.exec:\hbnnbt.exe103⤵
-
\??\c:\jjvdd.exec:\jjvdd.exe104⤵
-
\??\c:\vvjdp.exec:\vvjdp.exe105⤵
-
\??\c:\vdjpp.exec:\vdjpp.exe106⤵
-
\??\c:\rlxfxxf.exec:\rlxfxxf.exe107⤵
-
\??\c:\1httbh.exec:\1httbh.exe108⤵
-
\??\c:\nhnnbh.exec:\nhnnbh.exe109⤵
-
\??\c:\vvjpp.exec:\vvjpp.exe110⤵
-
\??\c:\3dpvv.exec:\3dpvv.exe111⤵
-
\??\c:\ddpdj.exec:\ddpdj.exe112⤵
-
\??\c:\1rflxxx.exec:\1rflxxx.exe113⤵
-
\??\c:\xxflxxx.exec:\xxflxxx.exe114⤵
-
\??\c:\bbnntt.exec:\bbnntt.exe115⤵
-
\??\c:\ddddj.exec:\ddddj.exe116⤵
-
\??\c:\pjjvd.exec:\pjjvd.exe117⤵
-
\??\c:\5jjpj.exec:\5jjpj.exe118⤵
-
\??\c:\ffrrlrf.exec:\ffrrlrf.exe119⤵
- System Location Discovery: System Language Discovery
-
\??\c:\tbtntb.exec:\tbtntb.exe120⤵
-
\??\c:\1tbbtt.exec:\1tbbtt.exe121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-