Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27/12/2024, 01:19
General
-
Target
a57d34dc6a58c9c775ae4b49a7b430bbbbd24096aec0155d6213cad85b1df917.exe
-
Size
74KB
-
MD5
ac4c0bebe3916f45cc61474b7a471038
-
SHA1
d82e238ef725eb5e5d65dc0da7433a23f5f829af
-
SHA256
a57d34dc6a58c9c775ae4b49a7b430bbbbd24096aec0155d6213cad85b1df917
-
SHA512
0cb1584534a4b345df1116dd584a5f33952c49851394711692e70dd1790015076a811aa26cc5fce050b688c5ad5284fb4e6146fbcda0f6ec64249d070ec3ae90
-
SSDEEP
1536:IyfIcT9U1tPrgQvhLopacl1TsQk0NJP/PAjgas/3VUN0YWZPnouy8B:VfIS2vhLoz5sQkqgjg1YWZfoutB
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a57d34dc6a58c9c775ae4b49a7b430bbbbd24096aec0155d6213cad85b1df917.exe"C:\Users\Admin\AppData\Local\Temp\a57d34dc6a58c9c775ae4b49a7b430bbbbd24096aec0155d6213cad85b1df917.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Syslemohtxt.exe"C:\Users\Admin\AppData\Local\Temp\Syslemohtxt.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5bb04c05ce22212d801a85aa1068f1d6f
SHA16d47d162f5c766c477738e4f109b830f9dade4c5
SHA25620f295f90be106624730f55ec09e99a048ffa30e08f25d8c45d0b7eb2de20c2a
SHA512c0d4dba8b4773d9034963d0e88a498313f7c19a80f0fb143efd8c4d98db1203c1cc2369175956fe04322c3eb01c1dff17347f5eb674ad57fc74c9cf4cc789dfe
-
Filesize
102B
MD5cde383206f6ab85887644a64fa8596fe
SHA151fa328b7e7b023e51e3bbfa192e74dbccb2c43f
SHA25679ff631d442a41106400498ce1722a8120597822cf8251e112361e85edac7a96
SHA512bba42b3e665e6bda90ff8e8b97d2b8ffa3f1a60671ea1171d2932242131bca2f33e29298ce317b1935219aa1a9ba0eb1f44f80d951faf2e85d50da6ea4e2478d
-
Filesize
444KB
-
Filesize
444KB
-
Filesize
444KB
-
Filesize
444KB