Analysis

  • max time kernel
    139s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02-01-2025 10:14

General

  • Target

    ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe

  • Size

    135KB

  • MD5

    df8b866a627276896b882e843caedbfa

  • SHA1

    19e752365adeb77e37e5288b8a95a92f41d6ded2

  • SHA256

    ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5

  • SHA512

    a8a831d6082a6194721c88ed81e4d39458a035ee39366d5a79438a3e2eb3662919c7d20cb82195479d0cab259ae65214ac60805fc6d11e767f45b532d46db9e1

  • SSDEEP

    3072:1lRG2oPJF4uJgJqcM8420jeAA3IY3atZWN0:1lEWuOJqc22y4B3H

Malware Config

Signatures

  • Blackmoon family
  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 3 IoCs
  • FatalRat

    FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

  • Fatalrat family
  • Fatal Rat payload 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 63 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    1⤵
      PID:604
    • C:\Users\Admin\AppData\Local\Temp\ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe
      "C:\Users\Admin\AppData\Local\Temp\ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe"
      1⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2612
      • C:\Users\Admin\AppData\Local\Temp\6og7zt1tpnz7fzf\spower.exe
        C:\Users\Admin\AppData\Local\Temp\6og7zt1tpnz7fzf\spower.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2832
      • C:\ProgramData\NVIDIARV\svchost.exe
        C:\ProgramData\NVIDIARV\svchost.exe
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2800
      • C:\Windows\SysWOW64\SCHTASKS.exe
        SCHTASKS /Create /SC ONLOGON /TN WindowsUpdata /F /RL HIGHEST /TR C:\Users\Public\Pictures6og7zt1t\CCCef3Render.exe
        2⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2560

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \ProgramData\NVIDIARV\svchost.exe

      Filesize

      3.4MB

      MD5

      c42379ca208a33e2496ea4f5da6c9f24

      SHA1

      f0dc893080344a1873f84ee7221d5aa08a480e4a

      SHA256

      3106d03a8d2451396f2d799001e87d4f5393d58028f142c763356e20be9fbaf4

      SHA512

      73e5beb73a3ee9ca82cbe740d9ed84c7a03d3f0fb3b707273f7e93c22a09e1a0ac6ff9e353651c906dd608faff09c0c395eda4c7a213a15d164f1024b4580186

    • \Users\Admin\AppData\Local\Temp\6og7zt1tpnz7fzf\spower.exe

      Filesize

      2.7MB

      MD5

      ac30909929056007eaf0fbcf53c3a21f

      SHA1

      7046d48c84748b246ebaa1c0153e8f81d3b0acc1

      SHA256

      f11baf3657a9bbfeb5d140a37d456573f589212447446a1519033ad010b9f58f

      SHA512

      71a40652f3cdfbd33cfc539855d6cbb1fba601e83bbd4b3e4f5e397144b3abfed5d148b486aec4eec17136e063609f93beae72a5e78d12d876dd79ccd3c9c849

    • memory/604-33-0x0000000000400000-0x0000000000429000-memory.dmp

      Filesize

      164KB

    • memory/2612-35-0x0000000000400000-0x0000000000635000-memory.dmp

      Filesize

      2.2MB

    • memory/2612-16-0x0000000000400000-0x0000000000635000-memory.dmp

      Filesize

      2.2MB

    • memory/2612-50-0x0000000000400000-0x0000000000635000-memory.dmp

      Filesize

      2.2MB

    • memory/2612-0-0x0000000000400000-0x0000000000635000-memory.dmp

      Filesize

      2.2MB

    • memory/2800-45-0x0000000010000000-0x000000001002D000-memory.dmp

      Filesize

      180KB

    • memory/2800-43-0x0000000000400000-0x0000000000913000-memory.dmp

      Filesize

      5.1MB

    • memory/2832-27-0x0000000077550000-0x0000000077552000-memory.dmp

      Filesize

      8KB

    • memory/2832-34-0x000000013F9A1000-0x000000013FC21000-memory.dmp

      Filesize

      2.5MB

    • memory/2832-24-0x000000013F9A1000-0x000000013FC21000-memory.dmp

      Filesize

      2.5MB

    • memory/2832-25-0x0000000077550000-0x0000000077552000-memory.dmp

      Filesize

      8KB

    • memory/2832-29-0x0000000077550000-0x0000000077552000-memory.dmp

      Filesize

      8KB

    • memory/2832-30-0x000000013F930000-0x000000013FEDC000-memory.dmp

      Filesize

      5.7MB