Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    01-01-2025 15:44

General

  • Target

    486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe

  • Size

    2.8MB

  • MD5

    85cae604e479331c6fc1ad6f91f8baab

  • SHA1

    fca25f2e74001c4c632efbcf7cd9816530b53fa1

  • SHA256

    486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93

  • SHA512

    32bd4ca5a23ba455257d94d5164516d879e55e495e0a54341a4b44147b02869e482b6e83ab5f5e85798a85e741eaac21818cb42517a2f092c36683618f9c1a9a

  • SSDEEP

    24576:4l18GADX15DihL9GVRqIERogW68ngSTeTm8HZfj4cCao6A6u2EmAOuydnTX2tuiD:4O7SL9eq67ydBC/S2mpTnf1cF

Malware Config

Signatures

  • Blackmoon family
  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 1 IoCs
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • Privateloader family
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Stops running service(s) 4 TTPs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe
    "C:\Users\Admin\AppData\Local\Temp\486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe"
    1⤵
    • Sets service image path in registry
    • Enumerates connected drives
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2244
    • C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      2⤵
        PID:2776
      • C:\Windows\SysWOW64\CMD.exe
        CMD /C SC STOP roosbk
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1628
        • C:\Windows\SysWOW64\sc.exe
          SC STOP roosbk
          3⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:1528
      • C:\Windows\SysWOW64\CMD.exe
        CMD /C SC DELETE roosbk
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2748
        • C:\Windows\SysWOW64\sc.exe
          SC DELETE roosbk
          3⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:272
      • C:\Windows\SysWOW64\CMD.exe
        CMD /C SC STOP roosbk
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2524
        • C:\Windows\SysWOW64\sc.exe
          SC STOP roosbk
          3⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:1112
      • C:\Windows\SysWOW64\CMD.exe
        CMD /C SC DELETE roosbk
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2020
        • C:\Windows\SysWOW64\sc.exe
          SC DELETE roosbk
          3⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:2388

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\ËÙ¼°°ÌØȸÙÊ°ÖÎô°ÅÈÖµ¼Íͺ³ÒÄÁÕÙ»Æ̳²ËøÔк½ËÕ±ÂÂÚÓǸ´ÉÍÚºÀÒÑ¿·×È\ÄÙ±¿Éж¶ÎÇ»ÖÓ¼ÀÍسÅIJÕÊ»·Ìϲ¼ÃÔÔÁºÙËƱ³ÂËÓº¸ÒÉ¿Ú×ÀÄѱ·ÉȶÙο»ÐÓ¶ÀÇØØž²Ïʵ·ÆÏ×¼½ÔÎÁ²ÙÃÆÔ³ºË˸±Ð½ÓÕ¸ÂÉÚÚÇÀ´ÑÌ·¹ÈÑÙ¾¿ÖÐö°ÇÊØ·¾ÏÏ.lnk

      Filesize

      2.8MB

      MD5

      a878432e3c19e327650f5633ed4b66ae

      SHA1

      5412c6ae424bb9cf01560ce74b2be68bf3ac6bda

      SHA256

      5d1210e60be433829fc5ae3e04bf5a7c37b6a8de6559a65221e3937c9e76b11a

      SHA512

      4cd2a45857c1f3e0e008cc327a99f9117bc9f77c999fe2bf1e5b34e63392be518905f9cde80cdbd51f43be9649e230e17308e003642f3129f8a1b73b665a82a8

    • memory/2244-10-0x0000000010000000-0x0000000010025000-memory.dmp

      Filesize

      148KB

    • memory/2244-16-0x0000000000400000-0x0000000000701000-memory.dmp

      Filesize

      3.0MB

    • memory/2244-17-0x0000000000400000-0x0000000000701000-memory.dmp

      Filesize

      3.0MB

    • memory/2776-0-0x0000000000060000-0x0000000000068000-memory.dmp

      Filesize

      32KB

    • memory/2776-1-0x0000000000060000-0x0000000000068000-memory.dmp

      Filesize

      32KB