blackmoon | ca3c6aa65d838e2164af3b43a370e35dadd96938d8da0347cffe30cfa19cb3f3

Analysis

max time kernel
193s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 07:41

Target

lolyhzs_veryhuo.com/Copy.dll
Size

10KB
MD5

227c49fc0a7b41f866a1d54ebfbafe0b
SHA1

31509e73e059fa05b9aeccb783b153b85dfad43f
SHA256

3d5024975f55de9f1bb2a15bf53abe343af34e75426322ae70f183d72f74f6d8
SHA512

b73faa1300d554cabe397128ab2a3766f183b0917606801f490cebe5c500a314a85897e01325e31a60216a75c11faa4af314c68f4f0f2c1870b196efd5438e43
SSDEEP

192:xfnLgf74IyqhNGkEd+FIKiCj9QfyFtqS6yzsnIpYOFRzijmN:xfLg8IZh9Ed+fpZFtqUpHbOy

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1736-133-0x0000000010000000-0x000000001001A000-memory.dmp	family_blackmoon

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/1736-133-0x0000000010000000-0x000000001001A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1120 wrote to memory of 1736	1120	rundll32.exe	rundll32.exe
PID 1120 wrote to memory of 1736	1120	rundll32.exe	rundll32.exe
PID 1120 wrote to memory of 1736	1120	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lolyhzs_veryhuo.com\Copy.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1120

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lolyhzs_veryhuo.com\Copy.dll,#1
2⤵
PID:1736

memory/1736-132-0x0000000000000000-mapping.dmp

Download
memory/1736-133-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download