Analysis
- max time kernel
149s - max time network
99s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 20:29
General
- Target 6156d5d11c6703b1723aa04ddb7b5b8979b23bf7b249c2550baf43c3ce1c673a.exe
- Size 9.0MB
- Sample260511-y9h88sdw8p
- SHA256 6156d5d11c6703b1723aa04ddb7b5b8979b23bf7b249c2550baf43c3ce1c673a
Malware Config
Signatures
- Family: Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
- Detect Blackmoon payload 18 IoCs
- Drops file in Drivers directory 1 IoCs
- Possible privilege escalation attempt 2 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6156d5d11c6703b1723aa04ddb7b5b8979b23bf7b249c2550baf43c3ce1c673a.exe"C:\Users\Admin\AppData\Local\Temp\6156d5d11c6703b1723aa04ddb7b5b8979b23bf7b249c2550baf43c3ce1c673a.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\j.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\drivers\etc\hosts3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\drivers\etc\hosts /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\attrib.exeattrib -r -h -s C:\Windows\System32\drivers\etc\hosts3⤵
- Drops file in Drivers directory
- Views/modifies file attributes
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Mysql_data.ini
j.bat
memory/2348-0-0x0000000000400000-0x000000000198B000-memory.dmp
memory/2348-1-0x0000000000400000-0x000000000198B000-memory.dmp
memory/2348-3-0x0000000000400000-0x000000000198B000-memory.dmp
memory/2348-2-0x0000000000400000-0x000000000198B000-memory.dmp
memory/2348-4-0x0000000000400000-0x000000000198B000-memory.dmp
memory/2348-6-0x0000000001F30000-0x0000000001FEB000-memory.dmp
memory/2348-5-0x0000000000400000-0x000000000198B000-memory.dmp
memory/2348-10-0x0000000004BB0000-0x0000000004C6E000-memory.dmp
memory/2348-13-0x0000000004BB0000-0x0000000004C6E000-memory.dmp
memory/2348-14-0x0000000004C90000-0x0000000004CCE000-memory.dmp
memory/2348-12-0x0000000004BB0000-0x0000000004C6E000-memory.dmp
memory/2348-17-0x0000000004C90000-0x0000000004CCE000-memory.dmp
memory/2348-16-0x0000000004C90000-0x0000000004CCE000-memory.dmp
memory/2348-18-0x0000000004C90000-0x0000000004CCE000-memory.dmp
memory/2348-19-0x0000000004C90000-0x0000000004CCE000-memory.dmp
memory/2348-53-0x0000000004C90000-0x0000000004CCE000-memory.dmp
memory/2348-59-0x0000000004C90000-0x0000000004CCE000-memory.dmp
memory/2348-57-0x0000000004C90000-0x0000000004CCE000-memory.dmp
memory/2348-55-0x0000000004C90000-0x0000000004CCE000-memory.dmp
memory/2348-51-0x0000000004C90000-0x0000000004CCE000-memory.dmp
memory/2348-49-0x0000000004C90000-0x0000000004CCE000-memory.dmp
memory/2348-47-0x0000000004C90000-0x0000000004CCE000-memory.dmp
memory/2348-45-0x0000000004C90000-0x0000000004CCE000-memory.dmp
memory/2348-43-0x0000000004C90000-0x0000000004CCE000-memory.dmp
memory/2348-41-0x0000000004C90000-0x0000000004CCE000-memory.dmp
memory/2348-39-0x0000000004C90000-0x0000000004CCE000-memory.dmp
memory/2348-37-0x0000000004C90000-0x0000000004CCE000-memory.dmp
memory/2348-33-0x0000000004C90000-0x0000000004CCE000-memory.dmp
memory/2348-31-0x0000000004C90000-0x0000000004CCE000-memory.dmp
memory/2348-29-0x0000000004C90000-0x0000000004CCE000-memory.dmp
memory/2348-27-0x0000000004C90000-0x0000000004CCE000-memory.dmp
memory/2348-25-0x0000000004C90000-0x0000000004CCE000-memory.dmp
memory/2348-21-0x0000000004C90000-0x0000000004CCE000-memory.dmp
memory/2348-35-0x0000000004C90000-0x0000000004CCE000-memory.dmp
memory/2348-23-0x0000000004C90000-0x0000000004CCE000-memory.dmp
memory/2348-110-0x0000000001F30000-0x0000000001FEB000-memory.dmp
memory/2348-109-0x0000000000400000-0x000000000198B000-memory.dmp
memory/2348-112-0x0000000001F30000-0x0000000001FEB000-memory.dmp
memory/2348-111-0x0000000000400000-0x000000000198B000-memory.dmp
memory/2348-113-0x0000000000400000-0x000000000198B000-memory.dmp
memory/2348-115-0x0000000000400000-0x000000000198B000-memory.dmp
memory/2348-118-0x0000000001F30000-0x0000000001FEB000-memory.dmp
memory/2348-117-0x0000000000400000-0x000000000198B000-memory.dmp
memory/2348-119-0x0000000000400000-0x000000000198B000-memory.dmp
memory/2348-121-0x0000000000400000-0x000000000198B000-memory.dmp
memory/2348-124-0x0000000001F30000-0x0000000001FEB000-memory.dmp
memory/2348-123-0x0000000000400000-0x000000000198B000-memory.dmp
memory/2348-125-0x0000000000400000-0x000000000198B000-memory.dmp
memory/2348-127-0x0000000000400000-0x000000000198B000-memory.dmp
memory/2348-129-0x0000000000400000-0x000000000198B000-memory.dmp
memory/2348-131-0x0000000000400000-0x000000000198B000-memory.dmp
memory/2348-133-0x0000000000400000-0x000000000198B000-memory.dmp