Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
19-05-2024 12:19
General
-
Target
d2fe840c45bc4f60cba85e7e1709c3e993e9faed230f88e785988aacae68c3d3.dll
-
Size
15.1MB
-
MD5
ca455757a490342d08ddd0636282d1db
-
SHA1
bfc05e1baa642475b06048aeb09f4e90cd709e87
-
SHA256
d2fe840c45bc4f60cba85e7e1709c3e993e9faed230f88e785988aacae68c3d3
-
SHA512
954b9925669ce2fe44c65ee589a45b47588496d4a62facf583bb0a952ee9c44686f754a1df773713a12c8e7f1dcebef749b895c6cf383006518118ae57f2989f
-
SSDEEP
393216:aiIPTObyuJIOmTnMTW6vBfK+DlV3y7Prqt:aLPWGOpS+X36PWt
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 12 IoCs
-
Program crash 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d2fe840c45bc4f60cba85e7e1709c3e993e9faed230f88e785988aacae68c3d3.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d2fe840c45bc4f60cba85e7e1709c3e993e9faed230f88e785988aacae68c3d3.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 6323⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4828 -ip 48281⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32.9MB
-
Filesize
32.9MB
-
Filesize
32.9MB
-
Filesize
32.9MB
-
Filesize
32.9MB
-
Filesize
32.9MB
-
Filesize
32.9MB
-
Filesize
32.9MB
-
Filesize
32.9MB
-
Filesize
40KB
-
Filesize
32.9MB
-
Filesize
32.9MB
-
Filesize
2.7MB
-
Filesize
32.9MB
-
Filesize
32.9MB
-
Filesize
32.9MB