Analysis
-
max time kernel
140s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
28/03/2025, 08:25
General
-
Target
3c943c91da82f8f69c9bd2a3a80fad28ee3d6973526a034de074449360834e0c.exe
-
Size
2.0MB
-
MD5
304dc49d23f4684cf11a3865a8f6638e
-
SHA1
8f32cb2f77bb045713d3d00d095ba75231d7edae
-
SHA256
3c943c91da82f8f69c9bd2a3a80fad28ee3d6973526a034de074449360834e0c
-
SHA512
03c0f99e634bd1be880d7119ec7bba4d3a82417aa7d0a28bf509ed057eca14a75545a6de454fdab5c5240fa0623bed1206abc9e0c6af13e10295f586a8616ecf
-
SSDEEP
49152:Od7uWrA4X27PKu+tROA/nrOpZqLRcITUxe+raEFuQrb+7L:07nmr+fO4SpZqL5Axe/mHbwL
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
UPX packed file 39 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c943c91da82f8f69c9bd2a3a80fad28ee3d6973526a034de074449360834e0c.exe"C:\Users\Admin\AppData\Local\Temp\3c943c91da82f8f69c9bd2a3a80fad28ee3d6973526a034de074449360834e0c.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\data\Bugreport-327784.dllC:\Users\Admin\AppData\Local\Temp\data\Bugreport-327784.dll Bugreport %E9%AA%A8%E5%A4%B4QQ%E9%99%8C%E7%94%9F%E7%A9%BA%E9%97%B4%E7%95%99%E7%97%95%E8%B5%9E%202⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD5e13d6b07ebed6982b04ea356516df34f
SHA191c3f6a24560f50c9439e7f429429fe8c798db8b
SHA256d1c3e8e893a04ca542c104853c3ac9be320b32a4aa69c197d23e294c90df018a
SHA51224a3e99c824958168f6bc9fc73cb3f40dd2c59fee3881e6ac222a656b95e0fd24f233b498a924e7a475901f556753de36d5fbd2d67cab89dcc1e254bae052989
-
Filesize
113B
MD5c08af68cf838f156a1f227331a7ef436
SHA1b26d9d59db7c432fb54174c5ab0cf676a5a50aa2
SHA25697fd55b599a97d3e958d9db79d902f5193e99877d0cb160162269b4f7b4788b8
SHA51241b86d051e3fc3d7fcd5d99239ad48b6a09c120ab32a3b3b632bfc551596a8817eb5c7d89a90c66984d961667156735662c4fbd40d81948700cb7e9798ee6db8
-
Filesize
286B
MD50b2f1e393aa485c6f0c3fef48e74385e
SHA1a71245f91e2efabaa07dffd84d0a7a93eccdd12d
SHA256a2c2af1141d843e51263318115d3c519242b1ab61360d0fcd11615d26b4817d9
SHA5122038ad73c3ca02330c9d91d2be6cecfd0fe6907d0eb9397689eeb6a4c238d313e762258b94aef4bef1ebb41a6ec78188d14f214c6578b8c09e1ee174b039204f
-
Filesize
724KB
MD5a96fbd5e66b31f3d816ad80f623e9bd9
SHA14eda42260bd3eb930cd4eafd7d15c6af367bcf18
SHA2562e67ba278646fde95bb614dcbcc7da1c6bf7976c918b2c6ad3d78640000326f3
SHA51243921107313775ea14b1bd33cf758c13798f4fa1c1074771c1c96b1b43b98f3416d249ed8ab3171383772d0054829c3754a91b5e94135f1df6d67a76f599c80e
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
5.1MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
456KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
5.1MB
-
Filesize
252KB
-
Filesize
456KB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
252KB
-
Filesize
456KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
4KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB