Overview

overview

10

Static

static

10

5588ff784b...9N.exe

windows7-x64

10

5588ff784b...9N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-12-2024 04:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5588ff784ba3a7cb1098ee43b264c1827f8dcdeb6112f7506020787a567ceb19N.exe

  • Size

    366KB

  • MD5

    b2791d470ef60f08a129fcfc6c03d610

  • SHA1

    1055e343bf6ec8daf26d8727401b99a39eeb0e37

  • SHA256

    5588ff784ba3a7cb1098ee43b264c1827f8dcdeb6112f7506020787a567ceb19

  • SHA512

    60ba9d5c7b248ddcd024a89fb22adbdf43bc3c96570323e8e20171475ce9b585bbbba70995cca2a41a37fd713ad6889d8194d0a08fd1ddb0c4db70bbda45a63b

  • SSDEEP

    6144:BSfSHl+gv5gY1F53Aul/Egv4+E6qnwEGvIkJ7G9P1t:B2SHl+gv5gY1b5Eo4+EsEEIkJ7G9P1t

Score
10/10
blackmoonbankerdiscoverytrojan

Malware Config

Signatures

  • Blackmoon family
    blackmoon
  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon
  • Detect Blackmoon payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5588ff784ba3a7cb1098ee43b264c1827f8dcdeb6112f7506020787a567ceb19N.exe
    "C:\Users\Admin\AppData\Local\Temp\5588ff784ba3a7cb1098ee43b264c1827f8dcdeb6112f7506020787a567ceb19N.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1512
    • C:\Users\Admin\AppData\Local\Temp\Syslemfqxfy.exe
      "C:\Users\Admin\AppData\Local\Temp\Syslemfqxfy.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:788

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Syslemfqxfy.exe
    Filesize

    366KB

    MD5

    0d79069155081eb08b13036cfa403de6

    SHA1

    f943d1215fd3997c697f411be0d024d57957b905

    SHA256

    75a02cd92d784ca0c5d8eed055423e878a7d651ded00ec4770a7e29a567214c4

    SHA512

    843df38e9064efe5e041b4ac45234f051ea729ede26dfeb84559ea77d56e9b470c408cc8231487cbd7550fcd35ee7ed29f2024a786b5751acfe49305dd7c833a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\lpath.ini
    Filesize

    103B

    MD5

    f50998ea60d43818881a0cdc3644e64f

    SHA1

    3d369feeb21d5f5ac68cfaba8463107909fa0021

    SHA256

    3f09dae953213f704b7503c7350fe9f00cc17020c9bdbb0b06a06a8619d3a86f

    SHA512

    1d6f3ecbd58a867f398ba446472cf0923c3ee45b43e93b5a00d91cf96ac86fa9effd4e17203b4fdd4430554cd17a9e554dccdeaf1aa752085b7d34abe9c271c1

    Download Submit