Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
26/12/2024, 21:57
General
-
Target
e83616065672424b95d05561cfea7f7065abf653769f5a72e332ce4348592ba5.exe
-
Size
453KB
-
MD5
9c1fecad1cd23ea84cb2db7703cc25d6
-
SHA1
489b3363c7edf4d7873f434238f49f1a6906d5d4
-
SHA256
e83616065672424b95d05561cfea7f7065abf653769f5a72e332ce4348592ba5
-
SHA512
237b8364eed706af30327e7325d0161a77ce08dbecc64055175a20c763d63ea0d48e4a01d2fd9bf3298b90db90cf6acf11dda1186f191b22a7c028767a2b1c75
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Score
10/10
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 45 IoCs
-
Executes dropped EXE 64 IoCs
-
UPX packed file 45 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e83616065672424b95d05561cfea7f7065abf653769f5a72e332ce4348592ba5.exe"C:\Users\Admin\AppData\Local\Temp\e83616065672424b95d05561cfea7f7065abf653769f5a72e332ce4348592ba5.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\jddxlxv.exec:\jddxlxv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hxpfj.exec:\hxpfj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjffj.exec:\jjffj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vlrjxt.exec:\vlrjxt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tlrjf.exec:\tlrjf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvnrrrv.exec:\vvnrrrv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jhnhvh.exec:\jhnhvh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\txxflx.exec:\txxflx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dlvjhfd.exec:\dlvjhfd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xvvxxbd.exec:\xvvxxbd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdpld.exec:\vdpld.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbhbvn.exec:\bbhbvn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tdxtbhp.exec:\tdxtbhp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rvnht.exec:\rvnht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vbbfxlr.exec:\vbbfxlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lvlbn.exec:\lvlbn.exe17⤵
- Executes dropped EXE
-
\??\c:\xvppr.exec:\xvppr.exe18⤵
- Executes dropped EXE
-
\??\c:\xvfhpd.exec:\xvfhpd.exe19⤵
- Executes dropped EXE
-
\??\c:\tvtdnp.exec:\tvtdnp.exe20⤵
- Executes dropped EXE
-
\??\c:\pnvhf.exec:\pnvhf.exe21⤵
- Executes dropped EXE
-
\??\c:\tdrvlnh.exec:\tdrvlnh.exe22⤵
- Executes dropped EXE
-
\??\c:\jtjpb.exec:\jtjpb.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\nltvd.exec:\nltvd.exe24⤵
- Executes dropped EXE
-
\??\c:\xfpdp.exec:\xfpdp.exe25⤵
- Executes dropped EXE
-
\??\c:\vhnrt.exec:\vhnrt.exe26⤵
- Executes dropped EXE
-
\??\c:\vxvfjdb.exec:\vxvfjdb.exe27⤵
- Executes dropped EXE
-
\??\c:\vbnvf.exec:\vbnvf.exe28⤵
- Executes dropped EXE
-
\??\c:\rnvbrf.exec:\rnvbrf.exe29⤵
- Executes dropped EXE
-
\??\c:\bbfdxnf.exec:\bbfdxnf.exe30⤵
- Executes dropped EXE
-
\??\c:\hnvbdfp.exec:\hnvbdfp.exe31⤵
- Executes dropped EXE
-
\??\c:\rjtvh.exec:\rjtvh.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\fbljxv.exec:\fbljxv.exe33⤵
- Executes dropped EXE
-
\??\c:\dppxtn.exec:\dppxtn.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\pbrndp.exec:\pbrndp.exe35⤵
- Executes dropped EXE
-
\??\c:\jjrdn.exec:\jjrdn.exe36⤵
- Executes dropped EXE
-
\??\c:\bdtjvbj.exec:\bdtjvbj.exe37⤵
- Executes dropped EXE
-
\??\c:\rdbxxtj.exec:\rdbxxtj.exe38⤵
- Executes dropped EXE
-
\??\c:\tdfhxt.exec:\tdfhxt.exe39⤵
- Executes dropped EXE
-
\??\c:\jpjxhbr.exec:\jpjxhbr.exe40⤵
- Executes dropped EXE
-
\??\c:\rnbxhx.exec:\rnbxhx.exe41⤵
- Executes dropped EXE
-
\??\c:\prtrbv.exec:\prtrbv.exe42⤵
- Executes dropped EXE
-
\??\c:\ddpnbx.exec:\ddpnbx.exe43⤵
- Executes dropped EXE
-
\??\c:\ljbbvx.exec:\ljbbvx.exe44⤵
- Executes dropped EXE
-
\??\c:\nbfbv.exec:\nbfbv.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\lpjlhff.exec:\lpjlhff.exe46⤵
- Executes dropped EXE
-
\??\c:\ddntv.exec:\ddntv.exe47⤵
- Executes dropped EXE
-
\??\c:\rdjbj.exec:\rdjbj.exe48⤵
- Executes dropped EXE
-
\??\c:\fvtpb.exec:\fvtpb.exe49⤵
- Executes dropped EXE
-
\??\c:\bpblnr.exec:\bpblnr.exe50⤵
- Executes dropped EXE
-
\??\c:\btpdjh.exec:\btpdjh.exe51⤵
- Executes dropped EXE
-
\??\c:\bxbjhbb.exec:\bxbjhbb.exe52⤵
- Executes dropped EXE
-
\??\c:\ftfbt.exec:\ftfbt.exe53⤵
- Executes dropped EXE
-
\??\c:\nxfxdx.exec:\nxfxdx.exe54⤵
- Executes dropped EXE
-
\??\c:\xpnpprx.exec:\xpnpprx.exe55⤵
- Executes dropped EXE
-
\??\c:\bffxttx.exec:\bffxttx.exe56⤵
- Executes dropped EXE
-
\??\c:\vdllbbh.exec:\vdllbbh.exe57⤵
- Executes dropped EXE
-
\??\c:\rnjptrx.exec:\rnjptrx.exe58⤵
- Executes dropped EXE
-
\??\c:\xbtnh.exec:\xbtnh.exe59⤵
- Executes dropped EXE
-
\??\c:\tnrjd.exec:\tnrjd.exe60⤵
- Executes dropped EXE
-
\??\c:\xjnbhnd.exec:\xjnbhnd.exe61⤵
- Executes dropped EXE
-
\??\c:\xjnnxt.exec:\xjnnxt.exe62⤵
- Executes dropped EXE
-
\??\c:\xpfdb.exec:\xpfdb.exe63⤵
- Executes dropped EXE
-
\??\c:\ttvplx.exec:\ttvplx.exe64⤵
- Executes dropped EXE
-
\??\c:\vrxfjx.exec:\vrxfjx.exe65⤵
- Executes dropped EXE
-
\??\c:\jrtrvh.exec:\jrtrvh.exe66⤵
-
\??\c:\llfhjdp.exec:\llfhjdp.exe67⤵
-
\??\c:\dbvvrjx.exec:\dbvvrjx.exe68⤵
-
\??\c:\ptrhpd.exec:\ptrhpd.exe69⤵
-
\??\c:\vbfflht.exec:\vbfflht.exe70⤵
-
\??\c:\frhvfn.exec:\frhvfn.exe71⤵
-
\??\c:\xlblr.exec:\xlblr.exe72⤵
-
\??\c:\rtfvh.exec:\rtfvh.exe73⤵
-
\??\c:\xvfdb.exec:\xvfdb.exe74⤵
-
\??\c:\tvlxvhd.exec:\tvlxvhd.exe75⤵
-
\??\c:\vppdr.exec:\vppdr.exe76⤵
-
\??\c:\pvffjjn.exec:\pvffjjn.exe77⤵
-
\??\c:\hdhjnxf.exec:\hdhjnxf.exe78⤵
-
\??\c:\xlvtn.exec:\xlvtn.exe79⤵
-
\??\c:\hbvjpff.exec:\hbvjpff.exe80⤵
-
\??\c:\tdrlt.exec:\tdrlt.exe81⤵
-
\??\c:\rrbpbp.exec:\rrbpbp.exe82⤵
-
\??\c:\dbbdrdh.exec:\dbbdrdh.exe83⤵
-
\??\c:\rhhnnjn.exec:\rhhnnjn.exe84⤵
-
\??\c:\tvpdj.exec:\tvpdj.exe85⤵
-
\??\c:\jhlpbjl.exec:\jhlpbjl.exe86⤵
-
\??\c:\pvhhdvr.exec:\pvhhdvr.exe87⤵
-
\??\c:\hpjtx.exec:\hpjtx.exe88⤵
-
\??\c:\frvrbt.exec:\frvrbt.exe89⤵
-
\??\c:\xdhxhrv.exec:\xdhxhrv.exe90⤵
-
\??\c:\bpjvrxp.exec:\bpjvrxp.exe91⤵
-
\??\c:\pfpxtpl.exec:\pfpxtpl.exe92⤵
-
\??\c:\fjtdd.exec:\fjtdd.exe93⤵
-
\??\c:\btpprlh.exec:\btpprlh.exe94⤵
-
\??\c:\xjbdp.exec:\xjbdp.exe95⤵
-
\??\c:\xftlplp.exec:\xftlplp.exe96⤵
-
\??\c:\ptdxbb.exec:\ptdxbb.exe97⤵
-
\??\c:\vhpnl.exec:\vhpnl.exe98⤵
-
\??\c:\rnrxb.exec:\rnrxb.exe99⤵
-
\??\c:\xnpxbl.exec:\xnpxbl.exe100⤵
-
\??\c:\prhfpv.exec:\prhfpv.exe101⤵
-
\??\c:\bfthh.exec:\bfthh.exe102⤵
-
\??\c:\ntnbrjt.exec:\ntnbrjt.exe103⤵
-
\??\c:\ttddfd.exec:\ttddfd.exe104⤵
-
\??\c:\jbnxlvd.exec:\jbnxlvd.exe105⤵
-
\??\c:\xvnxjx.exec:\xvnxjx.exe106⤵
-
\??\c:\pxxdddj.exec:\pxxdddj.exe107⤵
-
\??\c:\lnfjrb.exec:\lnfjrb.exe108⤵
-
\??\c:\pbjjjdf.exec:\pbjjjdf.exe109⤵
-
\??\c:\tffvlnd.exec:\tffvlnd.exe110⤵
-
\??\c:\rphpxf.exec:\rphpxf.exe111⤵
-
\??\c:\xvthjn.exec:\xvthjn.exe112⤵
-
\??\c:\nnrxrfn.exec:\nnrxrfn.exe113⤵
-
\??\c:\btjtpnv.exec:\btjtpnv.exe114⤵
-
\??\c:\bxdpbh.exec:\bxdpbh.exe115⤵
-
\??\c:\jblbvjj.exec:\jblbvjj.exe116⤵
-
\??\c:\vbjnx.exec:\vbjnx.exe117⤵
-
\??\c:\flhlrh.exec:\flhlrh.exe118⤵
-
\??\c:\jvjdv.exec:\jvjdv.exe119⤵
- System Location Discovery: System Language Discovery
-
\??\c:\vpjvjbd.exec:\vpjvjbd.exe120⤵
-
\??\c:\prhxbbf.exec:\prhxbbf.exe121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-