Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
20-07-2023 11:19
General
-
Target
DKCat 7.7.exe
-
Size
17.4MB
-
MD5
e0a0b8edf30dcdfee7590ced1dd6e8b5
-
SHA1
f4ce8e489cbbff3f625d3976404c16a24ead8c4c
-
SHA256
93d97957ce5113fbda9dfdb10646e790df4b15f79ef5ff748131e48010f1c52a
-
SHA512
a077695fa283625f7a76f235b3a06cd630b635a4f62529415de741def39dbd61f7804ebb4251f4841ab149d98014675a56979a3b05d6459a2aac9b670216d1ca
-
SSDEEP
393216:Bo8bw8WlwxsQiasvvLNOmYg3r3d51AyzmkiF1XZETT:K8bwVwqhasvvLNfpbN5aYgvpUT
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 7 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DKCat 7.7.exe"C:\Users\Admin\AppData\Local\Temp\DKCat 7.7.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
-
Filesize
17.8MB
-
Filesize
17.8MB
-
Filesize
17.8MB
-
Filesize
144KB
-
Filesize
152KB
-
Filesize
17.8MB
-
Filesize
144KB
-
Filesize
152KB
-
Filesize
100KB
-
Filesize
17.8MB
-
Filesize
152KB