Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
25-12-2024 04:41
General
-
Target
05dcf10fca338b6872a52afb4935928fcc2575610f7e1f65ed3eb76b911e74c9.exe
-
Size
10.2MB
-
MD5
b79e05b90f69462bedd16ee5316f1efe
-
SHA1
724b5ef7823ad25d0a8fbb41fde972571fdc268a
-
SHA256
05dcf10fca338b6872a52afb4935928fcc2575610f7e1f65ed3eb76b911e74c9
-
SHA512
f54606c7a54afff00bf32824411cb5ae39ebd83d1498127d3601b8b333ee9bb6970e08c40e6d743caee1775ee866d4226ef7191829dfdc6c54309e8dffd0e47a
-
SSDEEP
98304:qvk38YyRM1xg3DEP1Y+OsUoD6NTxT5u3qLGhnjDKscdft6hrsP+76L49v2cLObHO:P8YyO1xg3a7VD6Nfkcdft6psPRL49/
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 1 IoCs
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\05dcf10fca338b6872a52afb4935928fcc2575610f7e1f65ed3eb76b911e74c9.exe"C:\Users\Admin\AppData\Local\Temp\05dcf10fca338b6872a52afb4935928fcc2575610f7e1f65ed3eb76b911e74c9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\05dcf10fca338b6872a52afb4935928fcc2575610f7e1f65ed3eb76b911e74c9.exeC:\Users\Admin\AppData\Local\Temp\05dcf10fca338b6872a52afb4935928fcc2575610f7e1f65ed3eb76b911e74c9.exe 400339035F03560370036603710370035F03420367036E036A036D035F0342037303730347036203770362035F0351036C0362036E036A036D0364035F0374036A036D036C03670370035F0349033B037103710334035C0344036003560337036F035F033A03370360034803660355036D03--aa`2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\winods\J8rr7_GcU4l\94cKeVn.exe"C:\Users\Admin\AppData\Roaming\winods\J8rr7_GcU4l\94cKeVn.exe"3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
369B
MD56e7c0de57fb453aef654e025c24d34bc
SHA15d0549a5ab1ab4ade57f3c6f024b786f68935a2c
SHA2565d7e6771522f5b9c3a8aa7a425425dfe2e437924daca9ffaeff932fce1742b67
SHA512fac734304d61edeb3f4dbb09c34c034e1532f7d24b18d265026bbb71ce675e80ebebbcb22df6ba6bd688fac64ca00f02b21baa5c9aba917d7aaac2944b56de7d
-
Filesize
2.1MB
MD58740ce1d9b7a8236c7145eb291fb7b06
SHA14d31f310f7d3c24aca4512633560ab58c34fb68b
SHA256a70c87b85e268dfb6c316124f7cb95a782d9a6f891a02de63b040c8ad28e3ecc
SHA512fcbec598448c135c2caef92671cde51df486830df00cad60c9c8907d321a6b65b74acdf80e7914a4148b17c1ed4d44940b2f56e4de1f27ffc3276a336a526470
-
Filesize
198KB
MD51f9d473236876e3304f82b145db5a7f1
SHA1d47a2f46a1997b789aa5e78683432a1b2e883353
SHA2566f9ba12ec828d1f64776e598345c9e0217de410a23e29be909721397764d5bbe
SHA51272bfa351818fa6cabd99b666bcf3a3a5ec1705b6c4cb9a80f64d37aee6694dadd08b1d28f40280436bfd1db42a5ffeeeec8834dd6d976ed320e9cdef88f36a10
-
Filesize
924KB
-
Filesize
4KB
-
Filesize
924KB
-
Filesize
4KB
-
Filesize
924KB
-
Filesize
4KB
-
Filesize
924KB
-
Filesize
940KB
-
Filesize
1.5MB
-
Filesize
2.1MB
-
Filesize
328KB