Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
26-12-2024 14:03
General
-
Target
548e6d58c5d96675888dacca801b0f742d31cdcbe79e439fd545e9a14db13507.exe
-
Size
456KB
-
MD5
049dca0ed3a4b4949db1e85fa7adec28
-
SHA1
cbb55b09bb6eb46cb0adb72b0df290b33a0b4d4a
-
SHA256
548e6d58c5d96675888dacca801b0f742d31cdcbe79e439fd545e9a14db13507
-
SHA512
689f0bbc6b9700fe12b6a517a3ffbe5f9aef628db7c6b07bba976287b4e74ecf54cd0a29b4b0af66e6a2393995c6702547e97d28c9000e62ecd0be6ceb085489
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR8:q7Tc2NYHUrAwfMp3CDR8
Score
10/10
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 38 IoCs
-
Executes dropped EXE 64 IoCs
-
UPX packed file 46 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\548e6d58c5d96675888dacca801b0f742d31cdcbe79e439fd545e9a14db13507.exe"C:\Users\Admin\AppData\Local\Temp\548e6d58c5d96675888dacca801b0f742d31cdcbe79e439fd545e9a14db13507.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\thtbbt.exec:\thtbbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjpvj.exec:\jjpvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7thhht.exec:\7thhht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5pdpj.exec:\5pdpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrllxxf.exec:\xrllxxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbntbb.exec:\hbntbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdjpp.exec:\pdjpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5nhhnh.exec:\5nhhnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjpjv.exec:\pjpjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfllfff.exec:\lfllfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thttbb.exec:\thttbb.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\xlrrxrx.exec:\xlrrxrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnthtt.exec:\bnthtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdpvd.exec:\pdpvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhtttt.exec:\nhtttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hthnnn.exec:\hthnnn.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\3frrrxx.exec:\3frrrxx.exe18⤵
- Executes dropped EXE
-
\??\c:\7hbbhh.exec:\7hbbhh.exe19⤵
- Executes dropped EXE
-
\??\c:\djpjj.exec:\djpjj.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\rrlllxl.exec:\rrlllxl.exe21⤵
- Executes dropped EXE
-
\??\c:\hthbhb.exec:\hthbhb.exe22⤵
- Executes dropped EXE
-
\??\c:\dvddj.exec:\dvddj.exe23⤵
- Executes dropped EXE
-
\??\c:\7nhtbb.exec:\7nhtbb.exe24⤵
- Executes dropped EXE
-
\??\c:\9pppp.exec:\9pppp.exe25⤵
- Executes dropped EXE
-
\??\c:\xrrflff.exec:\xrrflff.exe26⤵
- Executes dropped EXE
-
\??\c:\9bhbtt.exec:\9bhbtt.exe27⤵
- Executes dropped EXE
-
\??\c:\1xlrxfr.exec:\1xlrxfr.exe28⤵
- Executes dropped EXE
-
\??\c:\rflfrrr.exec:\rflfrrr.exe29⤵
- Executes dropped EXE
-
\??\c:\5pdjp.exec:\5pdjp.exe30⤵
- Executes dropped EXE
-
\??\c:\lfrxffr.exec:\lfrxffr.exe31⤵
- Executes dropped EXE
-
\??\c:\bbbbhb.exec:\bbbbhb.exe32⤵
- Executes dropped EXE
-
\??\c:\7djjj.exec:\7djjj.exe33⤵
- Executes dropped EXE
-
\??\c:\xlxxxlr.exec:\xlxxxlr.exe34⤵
- Executes dropped EXE
-
\??\c:\tthbbb.exec:\tthbbb.exe35⤵
- Executes dropped EXE
-
\??\c:\jdpjd.exec:\jdpjd.exe36⤵
- Executes dropped EXE
-
\??\c:\5dpjv.exec:\5dpjv.exe37⤵
- Executes dropped EXE
-
\??\c:\1frrrxx.exec:\1frrrxx.exe38⤵
- Executes dropped EXE
-
\??\c:\tntbhb.exec:\tntbhb.exe39⤵
- Executes dropped EXE
-
\??\c:\vjjjp.exec:\vjjjp.exe40⤵
- Executes dropped EXE
-
\??\c:\frxxfxx.exec:\frxxfxx.exe41⤵
- Executes dropped EXE
-
\??\c:\bbnttn.exec:\bbnttn.exe42⤵
- Executes dropped EXE
-
\??\c:\dpvjd.exec:\dpvjd.exe43⤵
- Executes dropped EXE
-
\??\c:\3fxrxrf.exec:\3fxrxrf.exe44⤵
- Executes dropped EXE
-
\??\c:\xlrxfrr.exec:\xlrxfrr.exe45⤵
- Executes dropped EXE
-
\??\c:\nthhnn.exec:\nthhnn.exe46⤵
- Executes dropped EXE
-
\??\c:\dpdjj.exec:\dpdjj.exe47⤵
- Executes dropped EXE
-
\??\c:\7rllllf.exec:\7rllllf.exe48⤵
- Executes dropped EXE
-
\??\c:\7xllxxf.exec:\7xllxxf.exe49⤵
- Executes dropped EXE
-
\??\c:\btbbbt.exec:\btbbbt.exe50⤵
- Executes dropped EXE
-
\??\c:\dpdvv.exec:\dpdvv.exe51⤵
- Executes dropped EXE
-
\??\c:\9xlfxxx.exec:\9xlfxxx.exe52⤵
- Executes dropped EXE
-
\??\c:\nbntbt.exec:\nbntbt.exe53⤵
- Executes dropped EXE
-
\??\c:\vpdvj.exec:\vpdvj.exe54⤵
- Executes dropped EXE
-
\??\c:\1pvvv.exec:\1pvvv.exe55⤵
- Executes dropped EXE
-
\??\c:\llxrrrl.exec:\llxrrrl.exe56⤵
- Executes dropped EXE
-
\??\c:\9htnnn.exec:\9htnnn.exe57⤵
- Executes dropped EXE
-
\??\c:\dvvdj.exec:\dvvdj.exe58⤵
- Executes dropped EXE
-
\??\c:\lxlxflx.exec:\lxlxflx.exe59⤵
- Executes dropped EXE
-
\??\c:\tnbbhh.exec:\tnbbhh.exe60⤵
- Executes dropped EXE
-
\??\c:\9vvpj.exec:\9vvpj.exe61⤵
- Executes dropped EXE
-
\??\c:\pdpvd.exec:\pdpvd.exe62⤵
- Executes dropped EXE
-
\??\c:\frfxffl.exec:\frfxffl.exe63⤵
- Executes dropped EXE
-
\??\c:\tnbhtt.exec:\tnbhtt.exe64⤵
- Executes dropped EXE
-
\??\c:\dpvjj.exec:\dpvjj.exe65⤵
- Executes dropped EXE
-
\??\c:\llrlrrx.exec:\llrlrrx.exe66⤵
-
\??\c:\bthbbb.exec:\bthbbb.exe67⤵
-
\??\c:\dvjvj.exec:\dvjvj.exe68⤵
-
\??\c:\pjpjj.exec:\pjpjj.exe69⤵
-
\??\c:\lfxxfxf.exec:\lfxxfxf.exe70⤵
-
\??\c:\9nhbbb.exec:\9nhbbb.exe71⤵
-
\??\c:\pjpdd.exec:\pjpdd.exe72⤵
-
\??\c:\5pdvv.exec:\5pdvv.exe73⤵
-
\??\c:\5flrrrx.exec:\5flrrrx.exe74⤵
-
\??\c:\hbnhbb.exec:\hbnhbb.exe75⤵
-
\??\c:\3hhnnn.exec:\3hhnnn.exe76⤵
-
\??\c:\jdjvv.exec:\jdjvv.exe77⤵
-
\??\c:\5lxrrll.exec:\5lxrrll.exe78⤵
-
\??\c:\bthbhh.exec:\bthbhh.exe79⤵
-
\??\c:\5bnnhh.exec:\5bnnhh.exe80⤵
-
\??\c:\dpvpv.exec:\dpvpv.exe81⤵
-
\??\c:\rlxrrrr.exec:\rlxrrrr.exe82⤵
-
\??\c:\1xflrlr.exec:\1xflrlr.exe83⤵
-
\??\c:\hbntht.exec:\hbntht.exe84⤵
-
\??\c:\dpddj.exec:\dpddj.exe85⤵
-
\??\c:\dpddj.exec:\dpddj.exe86⤵
-
\??\c:\1lxrffl.exec:\1lxrffl.exe87⤵
-
\??\c:\7flrrrx.exec:\7flrrrx.exe88⤵
-
\??\c:\nhbbnn.exec:\nhbbnn.exe89⤵
-
\??\c:\dvjjj.exec:\dvjjj.exe90⤵
-
\??\c:\rrffrrx.exec:\rrffrrx.exe91⤵
-
\??\c:\xlllrrx.exec:\xlllrrx.exe92⤵
-
\??\c:\1bnthh.exec:\1bnthh.exe93⤵
-
\??\c:\7jppd.exec:\7jppd.exe94⤵
-
\??\c:\1rrrffr.exec:\1rrrffr.exe95⤵
-
\??\c:\hbnhnt.exec:\hbnhnt.exe96⤵
-
\??\c:\vjddj.exec:\vjddj.exe97⤵
-
\??\c:\3vjvv.exec:\3vjvv.exe98⤵
-
\??\c:\fxllrrr.exec:\fxllrrr.exe99⤵
-
\??\c:\nbhbbb.exec:\nbhbbb.exe100⤵
-
\??\c:\3vdjp.exec:\3vdjp.exe101⤵
-
\??\c:\ppdjp.exec:\ppdjp.exe102⤵
-
\??\c:\7lflffl.exec:\7lflffl.exe103⤵
-
\??\c:\7nhbhh.exec:\7nhbhh.exe104⤵
-
\??\c:\jjvdp.exec:\jjvdp.exe105⤵
-
\??\c:\vpdvv.exec:\vpdvv.exe106⤵
-
\??\c:\lfxlrrx.exec:\lfxlrrx.exe107⤵
-
\??\c:\tbnhnh.exec:\tbnhnh.exe108⤵
-
\??\c:\dpvpp.exec:\dpvpp.exe109⤵
-
\??\c:\pjvdp.exec:\pjvdp.exe110⤵
-
\??\c:\xfflflx.exec:\xfflflx.exe111⤵
-
\??\c:\btntbb.exec:\btntbb.exe112⤵
-
\??\c:\jdjdp.exec:\jdjdp.exe113⤵
-
\??\c:\pdvjp.exec:\pdvjp.exe114⤵
-
\??\c:\1xffxlr.exec:\1xffxlr.exe115⤵
-
\??\c:\nhbtbt.exec:\nhbtbt.exe116⤵
-
\??\c:\jdjjj.exec:\jdjjj.exe117⤵
-
\??\c:\rfxxfff.exec:\rfxxfff.exe118⤵
-
\??\c:\frrfrlf.exec:\frrfrlf.exe119⤵
-
\??\c:\tntntt.exec:\tntntt.exe120⤵
-
\??\c:\pjdvp.exec:\pjdvp.exe121⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-