blackmoon | acb14740bdf32d9d73ec8f73d412768dadd225a35cd5c1f2584301f6e06a6a78

Analysis

max time kernel
148s
max time network
188s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 03:23

Target

acb14740bdf32d9d73ec8f73d412768dadd225a35cd5c1f2584301f6e06a6a78.dll
Size

14KB
MD5

f93b258a14e6a90c838cd5ea2e4a31e4
SHA1

0e7e4dd6f7fd614f0723c9687c6b18b5fdd36c26
SHA256

acb14740bdf32d9d73ec8f73d412768dadd225a35cd5c1f2584301f6e06a6a78
SHA512

aa2c65155be8924a589cdd2925bd9664dbb9e4216eee9b0cd6ee20fdfc95fde4e0c679c21a6a27921bae8c4a59dfbb1b595d60794971018c293c4e9b09bbb092
SSDEEP

384:pufPa2vDGDdapHm9BNmWMlEnL19sdbqpBBARbKeJH:oa2edb9HmZELLsdbIWRWeB

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1128-56-0x0000000010000000-0x0000000010013000-memory.dmp	family_blackmoon
behavioral1/memory/1128-57-0x0000000010000000-0x0000000010013000-memory.dmp	family_blackmoon

Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

5 1128 rundll32.exe
7 1128 rundll32.exe
9 1128 rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1644 wrote to memory of 1128	1644	rundll32.exe	rundll32.exe
PID 1644 wrote to memory of 1128	1644	rundll32.exe	rundll32.exe
PID 1644 wrote to memory of 1128	1644	rundll32.exe	rundll32.exe
PID 1644 wrote to memory of 1128	1644	rundll32.exe	rundll32.exe
PID 1644 wrote to memory of 1128	1644	rundll32.exe	rundll32.exe
PID 1644 wrote to memory of 1128	1644	rundll32.exe	rundll32.exe
PID 1644 wrote to memory of 1128	1644	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\acb14740bdf32d9d73ec8f73d412768dadd225a35cd5c1f2584301f6e06a6a78.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\acb14740bdf32d9d73ec8f73d412768dadd225a35cd5c1f2584301f6e06a6a78.dll,#1
2⤵
- Blocklisted process makes network request
PID:1128

memory/1128-54-0x0000000000000000-mapping.dmp

Download
memory/1128-55-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/1128-56-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1128-57-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download