Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 12:36
General
- Target da4e7faf20b0d8708f0d9ff84ca76637d0bbfed8a9659742df221761228f996b.exe
- Size 5.1MB
- Sample260511-ps5apsdt2k
- SHA256 da4e7faf20b0d8708f0d9ff84ca76637d0bbfed8a9659742df221761228f996b
Malware Config
Signatures
- Family: Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
- Detect Blackmoon payload 4 IoCs
- Downloads MZ/PE file 4 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Kills process with taskkill 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\da4e7faf20b0d8708f0d9ff84ca76637d0bbfed8a9659742df221761228f996b.exe"C:\Users\Admin\AppData\Local\Temp\da4e7faf20b0d8708f0d9ff84ca76637d0bbfed8a9659742df221761228f996b.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Users\Admin\Desktop\dsacxd\windows_E8jeYk.exe"C:\Users\Admin\Desktop\dsacxd\windows_E8jeYk.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE
3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE
windows_E8jeYk.exe
memory/1316-0-0x0000000000430000-0x000000000074A000-memory.dmp
memory/1316-30-0x0000000000430000-0x000000000074A000-memory.dmp
memory/1316-27-0x0000000003510000-0x0000000003574000-memory.dmp
memory/1316-5-0x0000000000400000-0x0000000000C64000-memory.dmp
memory/1316-3-0x0000000000400000-0x0000000000C64000-memory.dmp
memory/1316-2-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/1316-1-0x0000000002AB0000-0x0000000002AB1000-memory.dmp
memory/1316-31-0x0000000000400000-0x0000000000C64000-memory.dmp
memory/1984-6-0x0000000000C50000-0x0000000000CB4000-memory.dmp
memory/4012-32-0x0000000000400000-0x0000000000492000-memory.dmp
memory/4012-25-0x0000000000400000-0x0000000000492000-memory.dmp
memory/4012-29-0x00000000007D0000-0x00000000007DB000-memory.dmp
memory/4012-28-0x0000000000400000-0x0000000000492000-memory.dmp
memory/4012-38-0x0000000000A30000-0x0000000000A94000-memory.dmp
memory/4012-50-0x0000000000400000-0x0000000000492000-memory.dmp
memory/4012-70-0x0000000000400000-0x0000000000492000-memory.dmp
memory/4012-71-0x0000000000A30000-0x0000000000A94000-memory.dmp