Analysis
-
max time kernel
140s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
18-02-2025 04:56
General
-
Target
e2b6172d4b96e9e8059f6c2fd6fb951983e988602920b3b2069907abea89c72b.dll
-
Size
431KB
-
MD5
42ffeba32e0c3ca377b0dcc92e368053
-
SHA1
c7d471341e220deb366c946dc9da1f2f5b9f96bb
-
SHA256
e2b6172d4b96e9e8059f6c2fd6fb951983e988602920b3b2069907abea89c72b
-
SHA512
4fdb38d49010a2c879fcec4464898627538fb2c28435ae485ce3f8afc6015101b54492df4fa62d4f2dd80b39b103e57f771d9a2c7b6922b4916420ba97a63509
-
SSDEEP
12288:eemOG51BN127O5XnyrfrOAZL8PsO3BTyAhTTcc7vR/U6wYvoSOTEgTF:eemOG5NA74Xyrf3L83EAFIcrK6wYcTEC
Score
10/10
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 9 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e2b6172d4b96e9e8059f6c2fd6fb951983e988602920b3b2069907abea89c72b.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e2b6172d4b96e9e8059f6c2fd6fb951983e988602920b3b2069907abea89c72b.dll,#12⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
640KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB