Analysis
-
max time kernel
118s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
22-12-2024 11:51
General
-
Target
7739b4a762841a6fe867a7dd8366efbd99a8d98899cf00a54f9285b786b27e11N.exe
-
Size
74KB
-
MD5
fd6eeebf23e71cdef853a61fcfa49610
-
SHA1
a4181ad3e1cf803ab72f59e0b6cfab4ae73394a6
-
SHA256
7739b4a762841a6fe867a7dd8366efbd99a8d98899cf00a54f9285b786b27e11
-
SHA512
7583c94afb2fe5e7a70bc6952807c3ab4a713b7df0e59fbe5135888518e4bdb23d57448eef47e4d4e0f1ddcc6c6b95430a772ca51c2050acdb4b8a1d10f3395b
-
SSDEEP
1536:IyfIcT9U1tPrgQvhLopacl1TsQk0NJP/PAjgas/3VUN0YWZPnouy8L3:VfIS2vhLoz5sQkqgjg1YWZfoutT
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 61 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7739b4a762841a6fe867a7dd8366efbd99a8d98899cf00a54f9285b786b27e11N.exe"C:\Users\Admin\AppData\Local\Temp\7739b4a762841a6fe867a7dd8366efbd99a8d98899cf00a54f9285b786b27e11N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Syslemoolsm.exe"C:\Users\Admin\AppData\Local\Temp\Syslemoolsm.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
103B
MD58f9d4de22db35e9729df64bd10d904db
SHA1e8af07c7e93fa8e236ff8969c9558ce746b07bf5
SHA2565154c6e40fdccae9a15ec75959ed3d7429a588d5ee9c4efcaff597b7662e0ed3
SHA51244ab21751e0ae9dc3eca6af5ba2f3701e8aebcda4d5fedbba42541df573bad0ae58536eed3200affcacd604e967e5d374b7b5d61802c3bbd5b9ff44124ecb5cf
-
Filesize
74KB
MD52fd712992eae64652290aff2fa75bcbf
SHA124e654f127c91b4d37f2415d3d3ede301029c0d4
SHA25634cb33f795fb36e554dc715d524eaddc21e2b33736b700b0fc09d05458a627c4
SHA5126f89ac76e6e003716bdf493c9a3b853148590e3ec7aa0a89207cb140177e4d3b08d74c86ab49d5c528413cebf64f6cd5d6f6b4c83e71e7dd0502154b09bbc9a6
-
Filesize
444KB
-
Filesize
444KB
-
Filesize
444KB