Analysis
-
max time kernel
129s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
29/05/2024, 02:32
General
-
Target
f7e42a889c38d190fe6ab19b6b2fe5214faaa6d7358906f4dffdd9ef32a60077.exe
-
Size
9.4MB
-
MD5
1e13a2c8658c586222fc60facdc50e19
-
SHA1
b695c2cf8beb572fb2783742298b62d1a034efae
-
SHA256
f7e42a889c38d190fe6ab19b6b2fe5214faaa6d7358906f4dffdd9ef32a60077
-
SHA512
e490daf6063068f3fb27372d857c3d51677f4d744982a4a8d5e0fd3b3444287e5d67b91623baa16f21267262148ec0c5c5b4a27b54fbb37f90ef054356c702c3
-
SSDEEP
196608:R7bREPzZXyZ+n25iBtIzqNwmpOdRTK6lr3fimWDLlEQVZbtV:R7bSPzZCZaI4ImSg0xlZW3XZb
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 5 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7e42a889c38d190fe6ab19b6b2fe5214faaa6d7358906f4dffdd9ef32a60077.exe"C:\Users\Admin\AppData\Local\Temp\f7e42a889c38d190fe6ab19b6b2fe5214faaa6d7358906f4dffdd9ef32a60077.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 10722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2156 -ip 21561⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.8MB
-
Filesize
36KB
-
Filesize
23.8MB
-
Filesize
23.8MB
-
Filesize
3.7MB
-
Filesize
23.8MB