Analysis
-
max time kernel
141s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
20-07-2023 11:18
General
-
Target
DKCat 7.4.exe
-
Size
17.4MB
-
MD5
785083ed993ec3db4b98a85fe916cdb7
-
SHA1
433d00e265e8801fa5143351b3c07366837e3c31
-
SHA256
9bc28efb860a295f39925e82638ef63246056f325d4bb1476e393c1d938a4a14
-
SHA512
965edfd6e76be9c048149bbbda03efa7e43db65c9859d018acce6f44457bfde7f0d59cf6020f86036025137c3f2c876bf4fbdbe6d84bd6fc43da6e8fdb5744ce
-
SSDEEP
393216:8O5N4WLcbsQiasvvLNOmYg3r3d51AyzmkiFAVlELK:8O5N/cohasvvLNfpbN5aYg+zUK
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 7 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DKCat 7.4.exe"C:\Users\Admin\AppData\Local\Temp\DKCat 7.4.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
-
Filesize
17.8MB
-
Filesize
152KB
-
Filesize
144KB
-
Filesize
17.8MB
-
Filesize
17.8MB
-
Filesize
17.8MB
-
Filesize
144KB
-
Filesize
152KB
-
Filesize
100KB
-
Filesize
17.8MB
-
Filesize
152KB