Analysis
-
max time kernel
148s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-12-2024 15:41
General
-
Target
d8a962c01aefdd2a93c440cafe57b0ddcbd95208f13fd8015a1648aa99c8e74d.exe
-
Size
74KB
-
MD5
bcd4c107a4e12b065004c4ce99857bae
-
SHA1
6431fb3a13bf0338f84586ae2f1f4e559704e283
-
SHA256
d8a962c01aefdd2a93c440cafe57b0ddcbd95208f13fd8015a1648aa99c8e74d
-
SHA512
39f69d0adc9f902791377e2ff697b41ebb8fee9493004f62ea1c491d139b1afbd24912e3a9f3cb2d24af6b2eb6c6862382f9961dbdaa32a9dc1d448c63d2745d
-
SSDEEP
1536:IyfIcT9U1tPrgQvhLopacl1TsQk0NJP/PAjgas/3VUN0YWZPnouy8L1:VfIS2vhLoz5sQkqgjg1YWZfoutJ
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 3 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8a962c01aefdd2a93c440cafe57b0ddcbd95208f13fd8015a1648aa99c8e74d.exe"C:\Users\Admin\AppData\Local\Temp\d8a962c01aefdd2a93c440cafe57b0ddcbd95208f13fd8015a1648aa99c8e74d.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Syslemscejg.exe"C:\Users\Admin\AppData\Local\Temp\Syslemscejg.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
102B
MD5bc1a09b32c052e6b3498150233ff5cfe
SHA15a111e3bb1a66a07acbae2ef19fd67f80f834531
SHA256a15f6dd76844ec33b59a1d69643912fb578f9cbf2ac65a981f274a050339e50f
SHA512205366823044abd3153d054dd5f37bd32b5c27c0467aec37dcbd0eff84e8d4285fa7765dc106ccc07528689704894ab69f15d89e9d7af7ebdac087c8590e0fa6
-
Filesize
74KB
MD5c3bc9ba592bfd42525d3af46877d5a56
SHA139813926ad1af898685d6962cb1374a66d5cd52a
SHA256081e64268fd56a831f5e90591101c76c5235b78a1b3a42efd83385bc256c83b0
SHA5120438f526a540e9f87bce5083d58972d30369d2a2d0dbd02b2453ee435d457553e767dca8ce99f8b5ca952544a2bdc04cbedd03d51f6c530132a2179f985ce1a0
-
Filesize
444KB
-
Filesize
444KB
-
Filesize
444KB
-
Filesize
444KB
-
Filesize
444KB
-
Filesize
444KB