Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
23-12-2024 21:36
General
-
Target
593531001023132100789e165af32776bdcc32377d6fc7f215756e4e8519c4d9.exe
-
Size
454KB
-
MD5
cb8b26870b10c039c882fc9f5ff98db9
-
SHA1
a3677c5a249272134da6b6b59be0fb24b9184344
-
SHA256
593531001023132100789e165af32776bdcc32377d6fc7f215756e4e8519c4d9
-
SHA512
81a6c3b0e9d436319461afdba47e4dfc3b5c1d9b25e18ef1d3c67f420f75398262fc02ccb89cc60fd4073f25d04cf5c69e97c59703ce3c1f0afd5afb8fd2837b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbex:q7Tc2NYHUrAwfMp3CDx
Score
10/10
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 39 IoCs
-
Executes dropped EXE 64 IoCs
-
UPX packed file 49 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\593531001023132100789e165af32776bdcc32377d6fc7f215756e4e8519c4d9.exe"C:\Users\Admin\AppData\Local\Temp\593531001023132100789e165af32776bdcc32377d6fc7f215756e4e8519c4d9.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\vblnx.exec:\vblnx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpplf.exec:\vpplf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vlxfll.exec:\vlxfll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnldrv.exec:\hnldrv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnjpvdf.exec:\tnjpvdf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fljvdpr.exec:\fljvdpr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tfjbpj.exec:\tfjbpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbfnd.exec:\nbfnd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pbnnjhj.exec:\pbnnjhj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vhbll.exec:\vhbll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdjxx.exec:\jdjxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vrpndn.exec:\vrpndn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvhtbh.exec:\pvhtbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hrphp.exec:\hrphp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvbln.exec:\jvbln.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hlfflbn.exec:\hlfflbn.exe17⤵
- Executes dropped EXE
-
\??\c:\ppvjbxr.exec:\ppvjbxr.exe18⤵
- Executes dropped EXE
-
\??\c:\fxvtvt.exec:\fxvtvt.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\jxbjft.exec:\jxbjft.exe20⤵
- Executes dropped EXE
-
\??\c:\dnbrxbn.exec:\dnbrxbn.exe21⤵
- Executes dropped EXE
-
\??\c:\ddltj.exec:\ddltj.exe22⤵
- Executes dropped EXE
-
\??\c:\fhlflr.exec:\fhlflr.exe23⤵
- Executes dropped EXE
-
\??\c:\jhxfjn.exec:\jhxfjn.exe24⤵
- Executes dropped EXE
-
\??\c:\hxbxv.exec:\hxbxv.exe25⤵
- Executes dropped EXE
-
\??\c:\jjfnlx.exec:\jjfnlx.exe26⤵
- Executes dropped EXE
-
\??\c:\vbvvpl.exec:\vbvvpl.exe27⤵
- Executes dropped EXE
-
\??\c:\xnpdn.exec:\xnpdn.exe28⤵
- Executes dropped EXE
-
\??\c:\dnphx.exec:\dnphx.exe29⤵
- Executes dropped EXE
-
\??\c:\fvnjt.exec:\fvnjt.exe30⤵
- Executes dropped EXE
-
\??\c:\xbftjnd.exec:\xbftjnd.exe31⤵
- Executes dropped EXE
-
\??\c:\vhnhbl.exec:\vhnhbl.exe32⤵
- Executes dropped EXE
-
\??\c:\tfjhj.exec:\tfjhj.exe33⤵
- Executes dropped EXE
-
\??\c:\bjjtjvt.exec:\bjjtjvt.exe34⤵
- Executes dropped EXE
-
\??\c:\fhhpbv.exec:\fhhpbv.exe35⤵
- Executes dropped EXE
-
\??\c:\bhvtpj.exec:\bhvtpj.exe36⤵
- Executes dropped EXE
-
\??\c:\jhphdtd.exec:\jhphdtd.exe37⤵
- Executes dropped EXE
-
\??\c:\pvbhbft.exec:\pvbhbft.exe38⤵
- Executes dropped EXE
-
\??\c:\tffrjnr.exec:\tffrjnr.exe39⤵
- Executes dropped EXE
-
\??\c:\jjvvflf.exec:\jjvvflf.exe40⤵
- Executes dropped EXE
-
\??\c:\xnrdl.exec:\xnrdl.exe41⤵
- Executes dropped EXE
-
\??\c:\fjbtdlv.exec:\fjbtdlv.exe42⤵
- Executes dropped EXE
-
\??\c:\fdjllfh.exec:\fdjllfh.exe43⤵
- Executes dropped EXE
-
\??\c:\jplrjrj.exec:\jplrjrj.exe44⤵
- Executes dropped EXE
-
\??\c:\rdtpdj.exec:\rdtpdj.exe45⤵
- Executes dropped EXE
-
\??\c:\frbhhh.exec:\frbhhh.exe46⤵
- Executes dropped EXE
-
\??\c:\xtxfphj.exec:\xtxfphj.exe47⤵
- Executes dropped EXE
-
\??\c:\tjhfln.exec:\tjhfln.exe48⤵
- Executes dropped EXE
-
\??\c:\pjlxd.exec:\pjlxd.exe49⤵
- Executes dropped EXE
-
\??\c:\xbdvlp.exec:\xbdvlp.exe50⤵
- Executes dropped EXE
-
\??\c:\nppvfj.exec:\nppvfj.exe51⤵
- Executes dropped EXE
-
\??\c:\tpdpf.exec:\tpdpf.exe52⤵
- Executes dropped EXE
-
\??\c:\hflxtd.exec:\hflxtd.exe53⤵
- Executes dropped EXE
-
\??\c:\pdhtnb.exec:\pdhtnb.exe54⤵
- Executes dropped EXE
-
\??\c:\vjhpjl.exec:\vjhpjl.exe55⤵
- Executes dropped EXE
-
\??\c:\vtjvxrv.exec:\vtjvxrv.exe56⤵
- Executes dropped EXE
-
\??\c:\pbdnndj.exec:\pbdnndj.exe57⤵
- Executes dropped EXE
-
\??\c:\drnnhp.exec:\drnnhp.exe58⤵
- Executes dropped EXE
-
\??\c:\bnhlt.exec:\bnhlt.exe59⤵
- Executes dropped EXE
-
\??\c:\ldpnthx.exec:\ldpnthx.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\jdvth.exec:\jdvth.exe61⤵
- Executes dropped EXE
-
\??\c:\nrrbn.exec:\nrrbn.exe62⤵
- Executes dropped EXE
-
\??\c:\rdptl.exec:\rdptl.exe63⤵
- Executes dropped EXE
-
\??\c:\ldhnr.exec:\ldhnr.exe64⤵
- Executes dropped EXE
-
\??\c:\nrtvjll.exec:\nrtvjll.exe65⤵
- Executes dropped EXE
-
\??\c:\pnntb.exec:\pnntb.exe66⤵
-
\??\c:\brfpjxf.exec:\brfpjxf.exe67⤵
-
\??\c:\hvhdx.exec:\hvhdx.exe68⤵
-
\??\c:\vbtrdr.exec:\vbtrdr.exe69⤵
-
\??\c:\jlldt.exec:\jlldt.exe70⤵
-
\??\c:\djhtr.exec:\djhtr.exe71⤵
-
\??\c:\bdntlrb.exec:\bdntlrb.exe72⤵
-
\??\c:\pjvfhx.exec:\pjvfhx.exe73⤵
-
\??\c:\vtlbl.exec:\vtlbl.exe74⤵
-
\??\c:\vjlhlpl.exec:\vjlhlpl.exe75⤵
-
\??\c:\lttnvb.exec:\lttnvb.exe76⤵
-
\??\c:\vxdnltp.exec:\vxdnltp.exe77⤵
-
\??\c:\njrnjd.exec:\njrnjd.exe78⤵
-
\??\c:\pndjrlp.exec:\pndjrlp.exe79⤵
-
\??\c:\xhrdpxr.exec:\xhrdpxr.exe80⤵
-
\??\c:\lrbfbv.exec:\lrbfbv.exe81⤵
-
\??\c:\pxtbt.exec:\pxtbt.exe82⤵
-
\??\c:\pxxntt.exec:\pxxntt.exe83⤵
-
\??\c:\plnrxlj.exec:\plnrxlj.exe84⤵
-
\??\c:\jjbtblb.exec:\jjbtblb.exe85⤵
-
\??\c:\hnpjjnp.exec:\hnpjjnp.exe86⤵
-
\??\c:\nltnr.exec:\nltnr.exe87⤵
-
\??\c:\jlnjrb.exec:\jlnjrb.exe88⤵
-
\??\c:\jbffl.exec:\jbffl.exe89⤵
-
\??\c:\vjdrtx.exec:\vjdrtx.exe90⤵
-
\??\c:\jvthpt.exec:\jvthpt.exe91⤵
-
\??\c:\ltvrrrn.exec:\ltvrrrn.exe92⤵
-
\??\c:\nxrnhx.exec:\nxrnhx.exe93⤵
-
\??\c:\fbdjpp.exec:\fbdjpp.exe94⤵
-
\??\c:\fdnphfn.exec:\fdnphfn.exe95⤵
-
\??\c:\tpjfh.exec:\tpjfh.exe96⤵
-
\??\c:\ldfjthr.exec:\ldfjthr.exe97⤵
-
\??\c:\jxjjnrl.exec:\jxjjnrl.exe98⤵
-
\??\c:\fdvpn.exec:\fdvpn.exe99⤵
-
\??\c:\phfvvrd.exec:\phfvvrd.exe100⤵
-
\??\c:\nnflr.exec:\nnflr.exe101⤵
-
\??\c:\vljbnxv.exec:\vljbnxv.exe102⤵
-
\??\c:\fjjbnbn.exec:\fjjbnbn.exe103⤵
-
\??\c:\btpjvl.exec:\btpjvl.exe104⤵
-
\??\c:\phjxhxj.exec:\phjxhxj.exe105⤵
-
\??\c:\fblvn.exec:\fblvn.exe106⤵
-
\??\c:\jhplnn.exec:\jhplnn.exe107⤵
-
\??\c:\xdndh.exec:\xdndh.exe108⤵
-
\??\c:\dpjhbf.exec:\dpjhbf.exe109⤵
-
\??\c:\prfphb.exec:\prfphb.exe110⤵
-
\??\c:\bhntj.exec:\bhntj.exe111⤵
-
\??\c:\drptpnh.exec:\drptpnh.exe112⤵
-
\??\c:\vdpfjrv.exec:\vdpfjrv.exe113⤵
-
\??\c:\tvfvdj.exec:\tvfvdj.exe114⤵
-
\??\c:\flxbfj.exec:\flxbfj.exe115⤵
-
\??\c:\nvxjh.exec:\nvxjh.exe116⤵
-
\??\c:\pfdrdl.exec:\pfdrdl.exe117⤵
-
\??\c:\pbbpp.exec:\pbbpp.exe118⤵
- System Location Discovery: System Language Discovery
-
\??\c:\rnxrjh.exec:\rnxrjh.exe119⤵
-
\??\c:\xjrnbvh.exec:\xjrnbvh.exe120⤵
- System Location Discovery: System Language Discovery
-
\??\c:\rdnhhp.exec:\rdnhhp.exe121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-