Analysis

  • max time kernel
    106s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2025, 05:56

General

  • Target

    2025-07-03_942a1fa5d58920ac5db17a2aa33054ba_amadey_darkgate_elex_icedid_rhadamanthys_smoke-loader_st.exe

  • Size

    11.5MB

  • MD5

    942a1fa5d58920ac5db17a2aa33054ba

  • SHA1

    2a53dc3140654603d43b78d5f244af1bc8fb7259

  • SHA256

    f3e6518eeedfdca5e234fbb3d26cc68ffc2ffac65749387f85bb6fc78b59157f

  • SHA512

    c15405deebb6376de25ca662ceaedba0f50cb580c6e8552a5d8bf34d040686f0d2d2db4f0c8ba8203700282421e533dbd0724c544adab648a0c3b83fc168ddb0

  • SSDEEP

    196608:loZGBfWZ8p0SQGBfW2DOGBfW+OZPzmGP8O7PVKa:BWZApW2DWwGrhl

Malware Config

Signatures

  • Blackmoon family
  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 2 IoCs
  • UAC bypass 3 TTPs 1 IoCs
  • Adds policy Run key to start application 2 TTPs 1 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops autorun.inf file 1 TTPs 6 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • System policy modification 1 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-07-03_942a1fa5d58920ac5db17a2aa33054ba_amadey_darkgate_elex_icedid_rhadamanthys_smoke-loader_st.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-07-03_942a1fa5d58920ac5db17a2aa33054ba_amadey_darkgate_elex_icedid_rhadamanthys_smoke-loader_st.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4444
    • C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe
      "C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"
      2⤵
      • UAC bypass
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:4300
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4848
    • C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe
      C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:5820

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe

          Filesize

          11.5MB

          MD5

          942a1fa5d58920ac5db17a2aa33054ba

          SHA1

          2a53dc3140654603d43b78d5f244af1bc8fb7259

          SHA256

          f3e6518eeedfdca5e234fbb3d26cc68ffc2ffac65749387f85bb6fc78b59157f

          SHA512

          c15405deebb6376de25ca662ceaedba0f50cb580c6e8552a5d8bf34d040686f0d2d2db4f0c8ba8203700282421e533dbd0724c544adab648a0c3b83fc168ddb0

        • C:\a806a7f7e634bf7796\2010_x86.log.html

          Filesize

          81KB

          MD5

          04a5ed564ac2a16ab1f17ebca0a90da2

          SHA1

          ba9f23cf39002dcf815d41bd62bc645484ce1df2

          SHA256

          bfc52d24631a851dc3f32a68fc1620187bf3f4f45bc7b06dd05658c1888c67d6

          SHA512

          614cd0ff95336f695c17335f4bb54f6d4ffc8c041465b8370f56f5107b27d2fbac9d663787c1f2722a9dde85a01e4484e0675c188eadf2e91b3492547a7ef251

        • memory/4444-0-0x0000000000400000-0x000000000044D000-memory.dmp

          Filesize

          308KB