Analysis
-
max time kernel
119s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-12-2024 11:51
General
-
Target
7739b4a762841a6fe867a7dd8366efbd99a8d98899cf00a54f9285b786b27e11N.exe
-
Size
74KB
-
MD5
fd6eeebf23e71cdef853a61fcfa49610
-
SHA1
a4181ad3e1cf803ab72f59e0b6cfab4ae73394a6
-
SHA256
7739b4a762841a6fe867a7dd8366efbd99a8d98899cf00a54f9285b786b27e11
-
SHA512
7583c94afb2fe5e7a70bc6952807c3ab4a713b7df0e59fbe5135888518e4bdb23d57448eef47e4d4e0f1ddcc6c6b95430a772ca51c2050acdb4b8a1d10f3395b
-
SSDEEP
1536:IyfIcT9U1tPrgQvhLopacl1TsQk0NJP/PAjgas/3VUN0YWZPnouy8L3:VfIS2vhLoz5sQkqgjg1YWZfoutT
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7739b4a762841a6fe867a7dd8366efbd99a8d98899cf00a54f9285b786b27e11N.exe"C:\Users\Admin\AppData\Local\Temp\7739b4a762841a6fe867a7dd8366efbd99a8d98899cf00a54f9285b786b27e11N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Syslemlsnck.exe"C:\Users\Admin\AppData\Local\Temp\Syslemlsnck.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD50eb330b28ad7efe81dd2d1657f48a5d4
SHA1d2f1d9d0352ee67938161a80c637e3ffa7056629
SHA256fd97d66f46dc9475ec2ca8072c9bd0329daddbeeb40023d9f3ba91a65bf06620
SHA512a75975e57a623d73ddec8dc432b658839ce1f6dc12aad414bad6075f2760890073967c4ff192975107ebffb34fcb56d8cb43ae4e276301a97c401609962c67d7
-
Filesize
103B
MD58f9d4de22db35e9729df64bd10d904db
SHA1e8af07c7e93fa8e236ff8969c9558ce746b07bf5
SHA2565154c6e40fdccae9a15ec75959ed3d7429a588d5ee9c4efcaff597b7662e0ed3
SHA51244ab21751e0ae9dc3eca6af5ba2f3701e8aebcda4d5fedbba42541df573bad0ae58536eed3200affcacd604e967e5d374b7b5d61802c3bbd5b9ff44124ecb5cf
-
Filesize
444KB
-
Filesize
444KB
-
Filesize
444KB