Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-12-2024 15:41
General
-
Target
d8a962c01aefdd2a93c440cafe57b0ddcbd95208f13fd8015a1648aa99c8e74d.exe
-
Size
74KB
-
MD5
bcd4c107a4e12b065004c4ce99857bae
-
SHA1
6431fb3a13bf0338f84586ae2f1f4e559704e283
-
SHA256
d8a962c01aefdd2a93c440cafe57b0ddcbd95208f13fd8015a1648aa99c8e74d
-
SHA512
39f69d0adc9f902791377e2ff697b41ebb8fee9493004f62ea1c491d139b1afbd24912e3a9f3cb2d24af6b2eb6c6862382f9961dbdaa32a9dc1d448c63d2745d
-
SSDEEP
1536:IyfIcT9U1tPrgQvhLopacl1TsQk0NJP/PAjgas/3VUN0YWZPnouy8L1:VfIS2vhLoz5sQkqgjg1YWZfoutJ
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8a962c01aefdd2a93c440cafe57b0ddcbd95208f13fd8015a1648aa99c8e74d.exe"C:\Users\Admin\AppData\Local\Temp\d8a962c01aefdd2a93c440cafe57b0ddcbd95208f13fd8015a1648aa99c8e74d.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Syslemoucsx.exe"C:\Users\Admin\AppData\Local\Temp\Syslemoucsx.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5132de6f55236c193d41ef27cf31ab886
SHA19c6a5d0487d4b9f5998afc6bcb11c29d44102ce8
SHA256ab8bd36c26619ac5aeb2cfe3dbf4c8b7cb2288ea4737d8b8a3cc3a262baeaacb
SHA5121f37bd286cf6a8159dafec0e6b5fd1ef34fa802e353a13c619f4374e560895d75e3e8d92456e2f424191fbce5873dc8e950e88f178a0ab10805ae76e6ab19793
-
Filesize
102B
MD5bc1a09b32c052e6b3498150233ff5cfe
SHA15a111e3bb1a66a07acbae2ef19fd67f80f834531
SHA256a15f6dd76844ec33b59a1d69643912fb578f9cbf2ac65a981f274a050339e50f
SHA512205366823044abd3153d054dd5f37bd32b5c27c0467aec37dcbd0eff84e8d4285fa7765dc106ccc07528689704894ab69f15d89e9d7af7ebdac087c8590e0fa6
-
Filesize
444KB
-
Filesize
444KB
-
Filesize
444KB