Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-12-2024 15:41

General

  • Target

    4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe

  • Size

    74KB

  • MD5

    46d85a24ab5d5435e1ac054fd9514d9e

  • SHA1

    1d81c7986bc5f47078e50b2f41668eb16ec2bb15

  • SHA256

    4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da

  • SHA512

    951660395cee249aca77953c34d4af015ab8bb0ba0a7ccfc15f4a6033dfb0b182d667988da0c16e4a9af0744deaa6b64e5f07a7ab6aa47f1ed948ccbe512a35d

  • SSDEEP

    1536:Ow3g1JoEokN7SdJUsl9Uy90kEdms6DR9hCoQZuj5oLrWLL:r3gPodk1SdJUIR9RKmtzCoQZq5og

Malware Config

Signatures

  • Blackmoon family
  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 4 IoCs
  • FatalRat

    FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

  • Fatalrat family
  • Fatal Rat payload 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p
    1⤵
      PID:792
    • C:\Users\Admin\AppData\Local\Temp\4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe
      "C:\Users\Admin\AppData\Local\Temp\4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4784
      • C:\Users\Admin\AppData\Local\Temp\lbd95tprvtoesbp\spower.exe
        C:\Users\Admin\AppData\Local\Temp\lbd95tprvtoesbp\spower.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2548
      • C:\ProgramData\NVIDIARV\svchost.exe
        C:\ProgramData\NVIDIARV\svchost.exe
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4996
      • C:\Windows\SysWOW64\SCHTASKS.exe
        SCHTASKS /Create /SC ONLOGON /TN WindowsUpdata /F /RL HIGHEST /TR C:\Users\Public\Pictureslbd95tpr\CCCef3Render.exe
        2⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2248

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\NVIDIARV\svchost.exe

      Filesize

      3.4MB

      MD5

      c42379ca208a33e2496ea4f5da6c9f24

      SHA1

      f0dc893080344a1873f84ee7221d5aa08a480e4a

      SHA256

      3106d03a8d2451396f2d799001e87d4f5393d58028f142c763356e20be9fbaf4

      SHA512

      73e5beb73a3ee9ca82cbe740d9ed84c7a03d3f0fb3b707273f7e93c22a09e1a0ac6ff9e353651c906dd608faff09c0c395eda4c7a213a15d164f1024b4580186

    • C:\Users\Admin\AppData\Local\Temp\lbd95tprvtoesbp\spower.exe

      Filesize

      2.7MB

      MD5

      ac30909929056007eaf0fbcf53c3a21f

      SHA1

      7046d48c84748b246ebaa1c0153e8f81d3b0acc1

      SHA256

      f11baf3657a9bbfeb5d140a37d456573f589212447446a1519033ad010b9f58f

      SHA512

      71a40652f3cdfbd33cfc539855d6cbb1fba601e83bbd4b3e4f5e397144b3abfed5d148b486aec4eec17136e063609f93beae72a5e78d12d876dd79ccd3c9c849

    • memory/792-39-0x000002A9810D0000-0x000002A9810F9000-memory.dmp

      Filesize

      164KB

    • memory/792-24-0x000002A9810D0000-0x000002A9810F9000-memory.dmp

      Filesize

      164KB

    • memory/2548-25-0x00007FF796931000-0x00007FF796BB1000-memory.dmp

      Filesize

      2.5MB

    • memory/2548-18-0x00007FF796931000-0x00007FF796BB1000-memory.dmp

      Filesize

      2.5MB

    • memory/2548-19-0x00007FF8C6B50000-0x00007FF8C6B52000-memory.dmp

      Filesize

      8KB

    • memory/2548-26-0x00007FF7968C0000-0x00007FF796E6C000-memory.dmp

      Filesize

      5.7MB

    • memory/2548-23-0x00007FF7968C0000-0x00007FF796E6C000-memory.dmp

      Filesize

      5.7MB

    • memory/4784-0-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

    • memory/4784-13-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

    • memory/4784-2-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

    • memory/4784-38-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

    • memory/4784-1-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

    • memory/4996-31-0x0000000000400000-0x0000000000913000-memory.dmp

      Filesize

      5.1MB

    • memory/4996-32-0x0000000010000000-0x000000001002D000-memory.dmp

      Filesize

      180KB