Analysis

  • max time kernel
    103s
  • max time network
    103s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250619-en
  • resource tags

    arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03/07/2025, 05:56

General

  • Target

    2025-07-03_942a1fa5d58920ac5db17a2aa33054ba_amadey_darkgate_elex_icedid_rhadamanthys_smoke-loader_st.exe

  • Size

    11.5MB

  • MD5

    942a1fa5d58920ac5db17a2aa33054ba

  • SHA1

    2a53dc3140654603d43b78d5f244af1bc8fb7259

  • SHA256

    f3e6518eeedfdca5e234fbb3d26cc68ffc2ffac65749387f85bb6fc78b59157f

  • SHA512

    c15405deebb6376de25ca662ceaedba0f50cb580c6e8552a5d8bf34d040686f0d2d2db4f0c8ba8203700282421e533dbd0724c544adab648a0c3b83fc168ddb0

  • SSDEEP

    196608:loZGBfWZ8p0SQGBfW2DOGBfW+OZPzmGP8O7PVKa:BWZApW2DWwGrhl

Malware Config

Signatures

  • Blackmoon family
  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 2 IoCs
  • UAC bypass 3 TTPs 1 IoCs
  • Adds policy Run key to start application 2 TTPs 1 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops autorun.inf file 1 TTPs 6 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • System policy modification 1 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-07-03_942a1fa5d58920ac5db17a2aa33054ba_amadey_darkgate_elex_icedid_rhadamanthys_smoke-loader_st.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-07-03_942a1fa5d58920ac5db17a2aa33054ba_amadey_darkgate_elex_icedid_rhadamanthys_smoke-loader_st.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3696
    • C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe
      "C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"
      2⤵
      • UAC bypass
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:3888
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3460
    • C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe
      C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4476

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\scoped_dir2288_1659557369\CRX_INSTALL\offscreendocument.html

          Filesize

          495B

          MD5

          17a98e40b9a7e4f37653ae32f090774b

          SHA1

          1964cf2fd13f441b50911ea9041f20e08fe09291

          SHA256

          77a027659b58b7879152909df5451c654a5d34bf144fc19738ff12ce164750de

          SHA512

          d2ee7a769098328dffd741f646d8c6a29aab816960a00a83f0073306f7c7290e0ce6b8abafcb46d909b96e8763d8fb695750e7f4e4d79154b60422ae56a256c4

        • C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe

          Filesize

          11.5MB

          MD5

          942a1fa5d58920ac5db17a2aa33054ba

          SHA1

          2a53dc3140654603d43b78d5f244af1bc8fb7259

          SHA256

          f3e6518eeedfdca5e234fbb3d26cc68ffc2ffac65749387f85bb6fc78b59157f

          SHA512

          c15405deebb6376de25ca662ceaedba0f50cb580c6e8552a5d8bf34d040686f0d2d2db4f0c8ba8203700282421e533dbd0724c544adab648a0c3b83fc168ddb0

        • C:\f2afd64e4c6dbf29d5a061\2010_x86.log.html

          Filesize

          81KB

          MD5

          84352d781ee4832a58f083d26e958c74

          SHA1

          0d03dfb4dedfb3de3ece7e54f36c111d79043c94

          SHA256

          50620d25e3ab7a131cc463da7a1fcc72fb1d4092972560f23478623f4f5edd85

          SHA512

          78869867fd3f2c5233de5a67100cbb2773c610b59b125d14f61304d70fc5de2fdba5e61771000e7f182937239915ed0e455e687cb24eec79effadc160314a23a

        • memory/3696-0-0x0000000000400000-0x000000000044D000-memory.dmp

          Filesize

          308KB