94b0684d0dcd7dc59a7194f0b4cb2c1df9b6c3063e394068e021ccda96d6d30e

Analysis

max time kernel
149s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/07/2026, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
banking_trojan2.dll
Size 673.8MB
Sample260713-vlfxesct9n
SHA256 94b0684d0dcd7dc59a7194f0b4cb2c1df9b6c3063e394068e021ccda96d6d30e
MD5 9bf00e124e09988eb803f4c87583d2a9
SHA1 1d6aaba6b98b615dee7a3cfd4f98f7867866d896
SHA512 d33f49294ba53a9f23eff38abaf750b2d746fe2292ab9fe05c52ff76884d3b64ec7124cb1ab68fdb19fa78ffda6fcbe784f1dc94e0a3f776eaa5be4781c48b77
SSDEEP 12582912:MuixQhU56pxmbYpUXRTPjZRyuAAyLKTE/ps/yWZtwoRQ2U0XJUw:exQveh1ZRKAyeTE/O/yakC
TLSH
T129793317798680BFD0821E3AE93BA7D5273B76711F468C676BC0250CAE75FA1243E643
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5628	rundll32.exe
5628	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5848 wrote to memory of 5628	5848	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\banking_trojan2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\banking_trojan2.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:5628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5628-0-0x0000000002490000-0x0000000003490000-memory.dmp

Download