Analysis

  • max time kernel
    137s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24-12-2024 18:45

General

  • Target

    c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe

  • Size

    73KB

  • MD5

    0beb9c4cf55707358a5e5c2e1b77641a

  • SHA1

    f02072332c430f92020668f2341bb8dd4ebbac4e

  • SHA256

    c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95

  • SHA512

    bb3d70e4f26336b1d672f931c3552148c667fccf4197f16f6702cb1c3e542e19899236c448e4f85bac4f2e6d4f57ac329d8d41eb003d5dcb1f9af2f2c5cd21ce

  • SSDEEP

    1536:9VFF9aowJ5k3YkrQNSUgx9g038nUyho8P8Ox6DR9hCoQZuj5oLk01JT:Xv9aowc3YYeeWUyH8OyzCoQZq5ox

Malware Config

Signatures

  • Blackmoon family
  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 3 IoCs
  • FatalRat

    FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

  • Fatalrat family
  • Fatal Rat payload 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 63 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    1⤵
      PID:608
    • C:\Users\Admin\AppData\Local\Temp\c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe
      "C:\Users\Admin\AppData\Local\Temp\c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe"
      1⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2676
      • C:\Users\Admin\AppData\Local\Temp\m5ptt315p2mft09\spower.exe
        C:\Users\Admin\AppData\Local\Temp\m5ptt315p2mft09\spower.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3052
      • C:\ProgramData\NVIDIARV\svchost.exe
        C:\ProgramData\NVIDIARV\svchost.exe
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1508
      • C:\Windows\SysWOW64\SCHTASKS.exe
        SCHTASKS /Create /SC ONLOGON /TN WindowsUpdata /F /RL HIGHEST /TR C:\Users\Public\Picturesm5ptt315\CCCef3Render.exe
        2⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2960

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \ProgramData\NVIDIARV\svchost.exe

      Filesize

      3.4MB

      MD5

      c42379ca208a33e2496ea4f5da6c9f24

      SHA1

      f0dc893080344a1873f84ee7221d5aa08a480e4a

      SHA256

      3106d03a8d2451396f2d799001e87d4f5393d58028f142c763356e20be9fbaf4

      SHA512

      73e5beb73a3ee9ca82cbe740d9ed84c7a03d3f0fb3b707273f7e93c22a09e1a0ac6ff9e353651c906dd608faff09c0c395eda4c7a213a15d164f1024b4580186

    • \Users\Admin\AppData\Local\Temp\m5ptt315p2mft09\spower.exe

      Filesize

      2.7MB

      MD5

      ac30909929056007eaf0fbcf53c3a21f

      SHA1

      7046d48c84748b246ebaa1c0153e8f81d3b0acc1

      SHA256

      f11baf3657a9bbfeb5d140a37d456573f589212447446a1519033ad010b9f58f

      SHA512

      71a40652f3cdfbd33cfc539855d6cbb1fba601e83bbd4b3e4f5e397144b3abfed5d148b486aec4eec17136e063609f93beae72a5e78d12d876dd79ccd3c9c849

    • memory/608-35-0x00000000003A0000-0x00000000003C9000-memory.dmp

      Filesize

      164KB

    • memory/1508-49-0x0000000010000000-0x000000001002D000-memory.dmp

      Filesize

      180KB

    • memory/1508-47-0x0000000000400000-0x0000000000913000-memory.dmp

      Filesize

      5.1MB

    • memory/2676-18-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

    • memory/2676-0-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

    • memory/2676-54-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

    • memory/2676-46-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

    • memory/3052-31-0x000000013F981000-0x000000013FC01000-memory.dmp

      Filesize

      2.5MB

    • memory/3052-38-0x000000013F910000-0x000000013FEBC000-memory.dmp

      Filesize

      5.7MB

    • memory/3052-37-0x000000013F981000-0x000000013FC01000-memory.dmp

      Filesize

      2.5MB

    • memory/3052-26-0x0000000077C00000-0x0000000077C02000-memory.dmp

      Filesize

      8KB

    • memory/3052-28-0x0000000077C00000-0x0000000077C02000-memory.dmp

      Filesize

      8KB

    • memory/3052-30-0x0000000077C00000-0x0000000077C02000-memory.dmp

      Filesize

      8KB