Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-05-2024 11:41

General

  • Target

    a72211cfc8529dbed0f73381531db1167f99f02aeb4df80274ccebd5c0427d0b.exe

  • Size

    199KB

  • MD5

    23a55215fb77e612fb7edb719a7ae899

  • SHA1

    7452e374b1e6d43da2fa0f1f7f5e4ba4575f0a94

  • SHA256

    a72211cfc8529dbed0f73381531db1167f99f02aeb4df80274ccebd5c0427d0b

  • SHA512

    6d1a27f4abe5fae8d7112a01c199bb27fb8d72687735cadc48fad813f9367cc83ef8a17d44d14cb4d8909e5f9d6210f9d54ed0c183eb6189f8a70642c8e526fd

  • SSDEEP

    6144:vkVdGWKY9gc2clig+thbdmHDUBDPGHio:vkVIWKqlrDUBi

Score
10/10

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a72211cfc8529dbed0f73381531db1167f99f02aeb4df80274ccebd5c0427d0b.exe
    "C:\Users\Admin\AppData\Local\Temp\a72211cfc8529dbed0f73381531db1167f99f02aeb4df80274ccebd5c0427d0b.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4692-0-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/4692-1-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/4692-2-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/4692-3-0x0000000002170000-0x00000000021E3000-memory.dmp

    Filesize

    460KB

  • memory/4692-4-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/4692-5-0x0000000002170000-0x00000000021E3000-memory.dmp

    Filesize

    460KB

  • memory/4692-6-0x0000000002170000-0x00000000021E3000-memory.dmp

    Filesize

    460KB

  • memory/4692-7-0x0000000000400000-0x000000000048B000-memory.dmp

    Filesize

    556KB

  • memory/4692-8-0x0000000002170000-0x00000000021E3000-memory.dmp

    Filesize

    460KB