blackmoon | 1819831b43c421590d8742f7d94e9b0e9d8d9a82595cd3f43c77dc2566085185

Analysis

max time kernel
75s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 21:09

Target

1819831b43c421590d8742f7d94e9b0e9d8d9a82595cd3f43c77dc2566085185.exe
Size

65KB
MD5

7ec61f645aab81627a9482b7c34e4cb0
SHA1

de314b3879d216e55a9546f7c90f43a273cb2167
SHA256

1819831b43c421590d8742f7d94e9b0e9d8d9a82595cd3f43c77dc2566085185
SHA512

d8a7161317ccd361c77af943a456a455af939f80e3293d8ae2fb7963304e54f1c2bf27af94872ae68f6d7093cfd28e12c35f465b31ec93a9f318f6cec9a7ca06
SSDEEP

1536:qKr7HBW4K+N2hhzGeckCrFm+GTbUsEtlwMB2:b7HBWz+AnckUGTb3EDwA2

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral2/memory/3720-133-0x0000000002050000-0x000000000207C000-memory.dmp	family_blackmoon

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4908	3720	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\1819831b43c421590d8742f7d94e9b0e9d8d9a82595cd3f43c77dc2566085185.exe
"C:\Users\Admin\AppData\Local\Temp\1819831b43c421590d8742f7d94e9b0e9d8d9a82595cd3f43c77dc2566085185.exe"
1⤵
PID:3720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 552
  2⤵
  - Program crash
  PID:4908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3720 -ip 3720
1⤵
PID:992

memory/3720-132-0x0000000000430000-0x0000000000443000-memory.dmp

Filesize
76KB

Download
memory/3720-133-0x0000000002050000-0x000000000207C000-memory.dmp

Filesize
176KB

Download