blackmoon | 776ade29cb1614b5e33067bf5e088c56670408ef4df2f1c962b1d2982df2cc4a

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 20:01

Target

776ade29cb1614b5e33067bf5e088c56670408ef4df2f1c962b1d2982df2cc4a.dll
Size

2.4MB
MD5

fbc8d03c47a4f787d505edc8e9864ff2
SHA1

9a5fb35e51e08bccb74ef5fa2f7ea143d0ba14f3
SHA256

776ade29cb1614b5e33067bf5e088c56670408ef4df2f1c962b1d2982df2cc4a
SHA512

03a96e7b4797457fe8eaef660394bb4d0539dab9e26422388b42ea968d78e97faa1a9dee6b620d08049afbc2d058360cbc194fcbc839acb1b5376db693b1ae55
SSDEEP

49152:rSV95vDl8uSGoXemnBFFjzoNd82IOi47n2X0aYISwfwHT:r5Szs1Rd0aYISwfwz

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3044-134-0x0000000010000000-0x00000000104C7000-memory.dmp	family_blackmoon

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

rundll32.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 rundll32.exe
File opened for modification \??\PhysicalDrive0 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 3044 rundll32.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	rundll32.exe
File opened for modification	\??\PhysicalDrive0	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	3044	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4752 wrote to memory of 3044	4752	rundll32.exe	rundll32.exe
PID 4752 wrote to memory of 3044	4752	rundll32.exe	rundll32.exe
PID 4752 wrote to memory of 3044	4752	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\776ade29cb1614b5e33067bf5e088c56670408ef4df2f1c962b1d2982df2cc4a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4752

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/3044-132-0x0000000000000000-mapping.dmp

Download
memory/3044-133-0x0000000010000000-0x00000000104C7000-memory.dmp

Filesize
4.8MB

Download
memory/3044-134-0x0000000010000000-0x00000000104C7000-memory.dmp

Filesize
4.8MB

Download