blackmoon | 5e1c036e9b2f6801fca368d78557bc0257c0582befe8702f8c32e3b1a4a7b014

Analysis

max time kernel
91s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 18:55

Target

5e1c036e9b2f6801fca368d78557bc0257c0582befe8702f8c32e3b1a4a7b014.dll
Size

2.1MB
MD5

e140631ab79224484ae4fda102b744d9
SHA1

fd9485beac3ec8e65eeccb7ba9a42824692b4162
SHA256

5e1c036e9b2f6801fca368d78557bc0257c0582befe8702f8c32e3b1a4a7b014
SHA512

b21d0fde7be4080e1925fd5c06c48301373451b201e209f517469312256d052dfe722e36db434b91685e10ea584ecdb65ccdb8f46ef5819e21bd089e6f52d6bd
SSDEEP

49152:+nTnSJ1QleMf1D5xtL4P9nueWMZm9G1BIvM35aw3u:SMQECr34P9njGGTt5J3

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1340-133-0x0000000010000000-0x000000001041B000-memory.dmp	family_blackmoon
behavioral2/memory/1340-135-0x0000000010000000-0x000000001041B000-memory.dmp	family_blackmoon

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

6 1340 rundll32.exe
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

rundll32.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 rundll32.exe
File opened for modification \??\PhysicalDrive0 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 1340 rundll32.exe

flow	pid	process
6	1340	rundll32.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	rundll32.exe
File opened for modification	\??\PhysicalDrive0	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1340	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2824 wrote to memory of 1340	2824	rundll32.exe	rundll32.exe
PID 2824 wrote to memory of 1340	2824	rundll32.exe	rundll32.exe
PID 2824 wrote to memory of 1340	2824	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e1c036e9b2f6801fca368d78557bc0257c0582befe8702f8c32e3b1a4a7b014.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2824

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/1340-132-0x0000000000000000-mapping.dmp

Download
memory/1340-133-0x0000000010000000-0x000000001041B000-memory.dmp

Filesize
4.1MB

Download
memory/1340-135-0x0000000010000000-0x000000001041B000-memory.dmp

Filesize
4.1MB

Download