Analysis
-
max time kernel
141s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
28/03/2025, 08:13
General
-
Target
3c943c91da82f8f69c9bd2a3a80fad28ee3d6973526a034de074449360834e0c.exe
-
Size
2.0MB
-
MD5
304dc49d23f4684cf11a3865a8f6638e
-
SHA1
8f32cb2f77bb045713d3d00d095ba75231d7edae
-
SHA256
3c943c91da82f8f69c9bd2a3a80fad28ee3d6973526a034de074449360834e0c
-
SHA512
03c0f99e634bd1be880d7119ec7bba4d3a82417aa7d0a28bf509ed057eca14a75545a6de454fdab5c5240fa0623bed1206abc9e0c6af13e10295f586a8616ecf
-
SSDEEP
49152:Od7uWrA4X27PKu+tROA/nrOpZqLRcITUxe+raEFuQrb+7L:07nmr+fO4SpZqL5Axe/mHbwL
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
UPX packed file 38 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c943c91da82f8f69c9bd2a3a80fad28ee3d6973526a034de074449360834e0c.exe"C:\Users\Admin\AppData\Local\Temp\3c943c91da82f8f69c9bd2a3a80fad28ee3d6973526a034de074449360834e0c.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\data\Bugreport-262650.dllC:\Users\Admin\AppData\Local\Temp\data\Bugreport-262650.dll Bugreport %E9%AA%A8%E5%A4%B4QQ%E9%99%8C%E7%94%9F%E7%A9%BA%E9%97%B4%E7%95%99%E7%97%95%E8%B5%9E%202⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD5a285e02eee9dfb44b79133547534ba2d
SHA1a21f95bed7b55027a006024b4ba8cae485c4ee3e
SHA25651cb8733e664cea0596203f5ad8aecc325ced480033739370870b4b320d068a0
SHA5121ab95bce3041daedd129d17912bd8dcb71742fdb6d58dccc8705b42aabea9647b10aec7d2c596c277b218d66ebe95da575bd1efede0ad3c9af95e870744a4f68
-
Filesize
113B
MD57c12e1e9b8ae55b37e6937e650f5830d
SHA16b682ec50c1ab13d8774dbc793cbed38cac79e8f
SHA256cbff7ef2cf0c0621f7d810a73639d35e0750658122daaf86f4fc950116e3fab5
SHA512dd60c60681f2aa4c4124fd7ff2add4f4c97c57fdf76e39f0406a736ce837516fc5f542a062d5df1122eac7f4c473c460cfbe9f6d6a3f6a4c511ca552fa885ccf
-
Filesize
286B
MD5b4b8c90f8f166c667925748268e52e1b
SHA172b97884ca91994414ec0a7082979a3319ca14a6
SHA25685321380861d64f3754f11b0c67427c945a5e49213a390ab95c396ec43540c15
SHA5120f48da7943a1f2913e7236a42b7961d6d352013bad497ea106409ceb68d3be44674155b6f5252f95dd3cdc66bfa30dea5625e9871b291e3b730b6fd656967bc8
-
Filesize
1KB
MD54234ea30074792ee58e7a36009808831
SHA115ecab19d468218266f541898d7be2c0e334a561
SHA2564234957c0679bfee8362586f985e53eff76279064433cd799ec437d8e5534110
SHA512646cebac2a5d6235943ac4d996f6b3ec75c6ebc4f5ca189666252ae59110bfc3c0a2703aa128499f5eb55b659f953e7aa59d9472ab9a97871eac13017f98bf12
-
Filesize
724KB
MD5a96fbd5e66b31f3d816ad80f623e9bd9
SHA14eda42260bd3eb930cd4eafd7d15c6af367bcf18
SHA2562e67ba278646fde95bb614dcbcc7da1c6bf7976c918b2c6ad3d78640000326f3
SHA51243921107313775ea14b1bd33cf758c13798f4fa1c1074771c1c96b1b43b98f3416d249ed8ab3171383772d0054829c3754a91b5e94135f1df6d67a76f599c80e
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
5.1MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
5.1MB
-
Filesize
252KB
-
Filesize
456KB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
252KB
-
Filesize
5.1MB
-
Filesize
456KB
-
Filesize
456KB
-
Filesize
5.1MB
-
Filesize
4KB
-
Filesize
252KB
-
Filesize
5.1MB
-
Filesize
264KB
-
Filesize
264KB