Analysis
-
max time kernel
148s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27/12/2024, 01:19
General
-
Target
a57d34dc6a58c9c775ae4b49a7b430bbbbd24096aec0155d6213cad85b1df917.exe
-
Size
74KB
-
MD5
ac4c0bebe3916f45cc61474b7a471038
-
SHA1
d82e238ef725eb5e5d65dc0da7433a23f5f829af
-
SHA256
a57d34dc6a58c9c775ae4b49a7b430bbbbd24096aec0155d6213cad85b1df917
-
SHA512
0cb1584534a4b345df1116dd584a5f33952c49851394711692e70dd1790015076a811aa26cc5fce050b688c5ad5284fb4e6146fbcda0f6ec64249d070ec3ae90
-
SSDEEP
1536:IyfIcT9U1tPrgQvhLopacl1TsQk0NJP/PAjgas/3VUN0YWZPnouy8B:VfIS2vhLoz5sQkqgjg1YWZfoutB
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a57d34dc6a58c9c775ae4b49a7b430bbbbd24096aec0155d6213cad85b1df917.exe"C:\Users\Admin\AppData\Local\Temp\a57d34dc6a58c9c775ae4b49a7b430bbbbd24096aec0155d6213cad85b1df917.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Syslemsmlhi.exe"C:\Users\Admin\AppData\Local\Temp\Syslemsmlhi.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
102B
MD5cde383206f6ab85887644a64fa8596fe
SHA151fa328b7e7b023e51e3bbfa192e74dbccb2c43f
SHA25679ff631d442a41106400498ce1722a8120597822cf8251e112361e85edac7a96
SHA512bba42b3e665e6bda90ff8e8b97d2b8ffa3f1a60671ea1171d2932242131bca2f33e29298ce317b1935219aa1a9ba0eb1f44f80d951faf2e85d50da6ea4e2478d
-
Filesize
74KB
MD59741ff4bd45f3aef7a0034e2cf1ecd11
SHA1be5f7e03b6821d1962e79def15854e41de32a066
SHA256023f47980bfee960d0807bc9a08e271ca10edf455ad2c723ef67946d55eed9d5
SHA51293e304617d5ccb861ec6aa2b7444ad81a9b5db6e32173d7cb1a9730207927ca8ee83154a6dee0d9e8b59e4b5ea5ae6c5bb22d289280ea2c30eb0db5c687d9837
-
Filesize
444KB
-
Filesize
444KB
-
Filesize
444KB