Analysis
-
max time kernel
7s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
-
submitted
02-06-2024 00:06
General
-
Target
1992cf9a67fb4425.exe
-
Size
337KB
-
MD5
50280002e4fde1433c6c80a1178c2774
-
SHA1
27b3a07a5dd9edaeb7f3379e2fd023f72f779586
-
SHA256
d9aab9d934e3cce61759da398a607b7a2280b592269cae62a4ca2530b5bf4833
-
SHA512
8b9d2b96c7d4362d75656e108e7809d6bcad083f978a9b8d3aae00eedab029bffbbd03b756afc8c4a984d37f2a97361e99cac0f6e724cfa2b82f448949073271
-
SSDEEP
6144:udxWxRzGrfgHtJ7Z1taVeEL0BJDYaS76Faf/1rGbqjSSmjeP:udURzhbftA4HsaS7x/JGb1SmCP
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 3 IoCs
-
Sets file execution options in registry 2 TTPs 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1992cf9a67fb4425.exe"C:\Users\Admin\AppData\Local\Temp\1992cf9a67fb4425.exe"1⤵
- Sets file execution options in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
1.3MB