blackmoon | ba074cc13cf6636ae0578a7a6218c62b650ed129002ac41ce9cfde158a2bd012

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 13:42

Target

ba074cc13cf6636ae0578a7a6218c62b650ed129002ac41ce9cfde158a2bd012.dll
Size

156KB
MD5

6af815643fd22b27a3d29edc1458dc00
SHA1

e34570b2b07e5e305be5553eb7d9c2b545a46532
SHA256

ba074cc13cf6636ae0578a7a6218c62b650ed129002ac41ce9cfde158a2bd012
SHA512

8144d623dd2263224de1d2fa580aa34c3ea1eae4b3daada0419bc4ced68a69e0d39279cb8dfb240e6bbe78ac464e1c81ddf3c6b19e869aef34a036ded9a3e8b2
SSDEEP

3072:owC0qvztzqbU3nCwwqDYbsky/mik/cwt5VS/hCN7HVLB6F5+fFy/Q:owCpv4mCmUbs3/VOcwt5VS/INDV9o5Uv

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral1/memory/1204-56-0x0000000010000000-0x0000000010073000-memory.dmp	family_blackmoon

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1204-56-0x0000000010000000-0x0000000010073000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba074cc13cf6636ae0578a7a6218c62b650ed129002ac41ce9cfde158a2bd012.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba074cc13cf6636ae0578a7a6218c62b650ed129002ac41ce9cfde158a2bd012.dll,#1
  2⤵
  PID:1204

memory/1204-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1204-56-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download