Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24-12-2024 00:45
General
-
Target
c64b2ef7e5c9460dc464f682ba24aab7818c839e222178621697f9ba07b402c8.exe
-
Size
7.5MB
-
MD5
c88226d44adcffb4dc370b1024561c71
-
SHA1
44336057920c887f0497abb9db6acc5b517ae5d4
-
SHA256
c64b2ef7e5c9460dc464f682ba24aab7818c839e222178621697f9ba07b402c8
-
SHA512
4782d3d3f17c203841644a8d061f10a0448cfaae852848ea1a3bf31ba3befe859c4c09d9e0f192d22719f9c2211540f2c220807ef3f91cadd43692a78b1ea1ab
-
SSDEEP
98304:TPF75Ej5VK+568kTjE5D7R5z8yDB+EM181mGgKvoPc2r6GDNMs1B7X8jEExDrWMl:5+VWA5RbDBBYz6GheAE0MZCCLyUS7NXq
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 17 IoCs
-
Drops file in Drivers directory 4 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c64b2ef7e5c9460dc464f682ba24aab7818c839e222178621697f9ba07b402c8.exe"C:\Users\Admin\AppData\Local\Temp\c64b2ef7e5c9460dc464f682ba24aab7818c839e222178621697f9ba07b402c8.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
114B
MD540f9e0ee8fe9d23ab654fae5754cb9a6
SHA1dccae241c87fffe78a4ac7263e68cfcfb1997649
SHA2563f7907656b67120c440f9eab5fdeb4ec601c1a3cb42165552aa964f87e71619f
SHA512696b649b518cbd04330216e4f2ed7f37909a4250539c5e78a5a0e3cc038c25880eb105f8500e63ccf92180b1b96e983426b46d566f31386a2857945df2789553
-
Filesize
21.6MB
-
Filesize
21.6MB
-
Filesize
4KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
4KB
-
Filesize
21.6MB
-
Filesize
21.6MB
-
Filesize
21.6MB
-
Filesize
21.6MB
-
Filesize
21.6MB
-
Filesize
21.6MB
-
Filesize
4KB
-
Filesize
21.6MB
-
Filesize
21.6MB
-
Filesize
21.6MB
-
Filesize
21.6MB
-
Filesize
21.6MB
-
Filesize
21.6MB
-
Filesize
21.6MB
-
Filesize
21.6MB
-
Filesize
21.6MB
-
Filesize
21.6MB