Analysis
-
max time kernel
119s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26-12-2024 14:03
General
-
Target
bcab184259b680515c5612631f13d103dce2c89758dc6123f6d6d217cfe1aeeb.exe
-
Size
74KB
-
MD5
4b36f4d8314038f422b7e28920ec2260
-
SHA1
7f55af361a460380e0669873059acc51bda949b1
-
SHA256
bcab184259b680515c5612631f13d103dce2c89758dc6123f6d6d217cfe1aeeb
-
SHA512
4ce2121d87477ed385ad5a0cd9e9ec1fff5eea3c747fe8923c3f8f24b34def0c4a6eb352107cbfdc8660f8caf679313671267c5c33e814c937a37afe18cfcea3
-
SSDEEP
1536:IyfIcT9U1tPrgQvhLopacl1TsQk0NJP/PAjgas/3VUN0YWZPnouy8Lt:VfIS2vhLoz5sQkqgjg1YWZfout5
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcab184259b680515c5612631f13d103dce2c89758dc6123f6d6d217cfe1aeeb.exe"C:\Users\Admin\AppData\Local\Temp\bcab184259b680515c5612631f13d103dce2c89758dc6123f6d6d217cfe1aeeb.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Syslemlqort.exe"C:\Users\Admin\AppData\Local\Temp\Syslemlqort.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD59c6c861ccd4357b1914d2d68122df523
SHA162f2758267df04094b086d8af0a78b1b4fd66524
SHA256ad5a42dcfcab6c976f164bbd3ef77a9a5703d857cc93eae67db8041415494761
SHA5122f5212c05b199002a63f8446215159aa48ed112470e3a3e5f234961f2b91e9449089147cfe7b4f059aaf0754af779433e7ee56de874bf0bb52f56ac354ad53da
-
Filesize
102B
MD5a72659088a268781438f2fdb47a4fe36
SHA1a1ccb476935796f0d64178bb21620dc2c3bd0473
SHA256a87a2fa7d603af99710af1cf0900beb1b2195803b1e842835ba55b9f5460c26c
SHA512d1a1a6dcd1297dc1bbf7f261fcbf53953ab99a48591bb4e1be01eb22c4f725d799b4aaefbbef017fdcbe2584adada16b1a85b4a686e58e27b94e8baf57c0da87
-
Filesize
444KB
-
Filesize
444KB
-
Filesize
444KB