blackmoon | 0cf826c1d9c49f4348a2466120849e48c8092ba525493be51709ddd33762cd00

Analysis

max time kernel
153s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2022 23:35

Target

0cf826c1d9c49f4348a2466120849e48c8092ba525493be51709ddd33762cd00.dll
Size

80KB
MD5

91736a6edf7ba0ff3883de008c6dd1ee
SHA1

97d8a09de7272e7b8b74df5e402aa3620b7307e7
SHA256

0cf826c1d9c49f4348a2466120849e48c8092ba525493be51709ddd33762cd00
SHA512

41bfa5f8d8dcedb6c63e0360ad5d4fcf8de23d38a7df037a325a7155d650cad3104acf691674d7b1eebaf9db34739c83463f9ec9df000390a763efdba6ed45f3
SSDEEP

768:TmvT5hPKXIm//39QqUCaNadrla2sI5ccdmGLkiGuWxZ:cH5m/P9xUCDdrY2s9QZ4xZ

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

resource	yara_rule
behavioral2/memory/3792-133-0x0000000010000000-0x0000000010014000-memory.dmp	family_blackmoon
behavioral2/memory/3792-134-0x0000000010000000-0x0000000010014000-memory.dmp	family_blackmoon

Blocklisted process makes network request 31 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 3792	4100	rundll32.exe	81
PID 4100 wrote to memory of 3792	4100	rundll32.exe	81
PID 4100 wrote to memory of 3792	4100	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0cf826c1d9c49f4348a2466120849e48c8092ba525493be51709ddd33762cd00.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0cf826c1d9c49f4348a2466120849e48c8092ba525493be51709ddd33762cd00.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:3792

memory/3792-133-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/3792-134-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download