File name:

acde91920549c78f413ea3fa20b2206aeef21c8a697085e7beab62911dd0fe82

Full analysis: https://app.any.run/tasks/addba803-98fb-4d69-821e-15c33a9066c0
Verdict: Malicious activity
Threats:

BlackMoon also known as KrBanker is a trojan aimed at stealing payment credentials. It specializes in man-in-the-browser (MitB) attacks, web injection, and credential theft to compromise users' online banking accounts. It was first noticed in early 2014 attacking banks in South Korea and has impressively evolved since by adding a number of new infiltration techniques and information stealing methods.

Analysis date: January 10, 2025, 18:28:46
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
blackmoon
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

F44545848CA9B1261DE96CA55047A58A

SHA1:

02D3B8149E3DBC6E9DD5410E9B2D4247A6C42377

SHA256:

ACDE91920549C78F413EA3FA20B2206AEEF21C8A697085E7BEAB62911DD0FE82

SSDEEP:

24576:DcO83uGeB+AtNPtRelC9L1wat76ZZzHxf0HVAGV6zKP/txJGxCAba395TL7btG:Dc13uGeB+AtNPtRelC9L1wat76ZZzRfF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • BLACKMOON has been detected (YARA)

      • acde91920549c78f413ea3fa20b2206aeef21c8a697085e7beab62911dd0fe82.exe (PID: 6472)
  • SUSPICIOUS

    • Creates file in the systems drive root

      • acde91920549c78f413ea3fa20b2206aeef21c8a697085e7beab62911dd0fe82.exe (PID: 6472)
  • INFO

    • The sample compiled with chinese language support

      • acde91920549c78f413ea3fa20b2206aeef21c8a697085e7beab62911dd0fe82.exe (PID: 6472)
    • Checks supported languages

      • acde91920549c78f413ea3fa20b2206aeef21c8a697085e7beab62911dd0fe82.exe (PID: 6472)
    • Reads the computer name

      • acde91920549c78f413ea3fa20b2206aeef21c8a697085e7beab62911dd0fe82.exe (PID: 6472)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:01:10 14:40:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 712704
InitializedDataSize: 4096
UninitializedDataSize: 2371584
EntryPoint: 0x2f0ea0
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileVersion: 1.0.0.0
FileDescription: 易语言程序
ProductName: 易语言程序
ProductVersion: 1.0.0.0
LegalCopyright: 作者版权所有 请尊重并使用正版
Comments: 本程序使用易语言编写(http://www.eyuyan.com)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
116
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #BLACKMOON acde91920549c78f413ea3fa20b2206aeef21c8a697085e7beab62911dd0fe82.exe

Process information

PID
CMD
Path
Indicators
Parent process
6472"C:\Users\admin\Desktop\acde91920549c78f413ea3fa20b2206aeef21c8a697085e7beab62911dd0fe82.exe" C:\Users\admin\Desktop\acde91920549c78f413ea3fa20b2206aeef21c8a697085e7beab62911dd0fe82.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
易语言程序
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\acde91920549c78f413ea3fa20b2206aeef21c8a697085e7beab62911dd0fe82.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
166
Read events
166
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
32
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
1016
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2.23.227.215:443
www.bing.com
Ooredoo Q.S.C.
QA
unknown
4
System
192.168.100.255:138
unknown
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1016
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
4712
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
4712
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
unknown
1016
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
unknown
4712
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1016
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
unknown
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
  • 4.231.128.59
  • 40.127.240.158
unknown
google.com
  • 142.250.186.142
unknown
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
unknown
www.microsoft.com
  • 2.23.246.101
unknown
self.events.data.microsoft.com
  • 13.69.116.107
unknown

Threats

No threats detected
No debug info