blackmoon | 21091e6d7989c86c6f898a6b3d024d62cfb7c075e4c6f347e6db5f81e107143d

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 13:05

Target

21091e6d7989c86c6f898a6b3d024d62cfb7c075e4c6f347e6db5f81e107143d.dll
Size

334KB
MD5

8c5efc7e03db2d57e05b09feaa39ce80
SHA1

0c5add623ef557474040297819bb7923d63e0d92
SHA256

21091e6d7989c86c6f898a6b3d024d62cfb7c075e4c6f347e6db5f81e107143d
SHA512

7bd73d889fa82006fba059eb35676607f8c62c91314eac86b809bf630ccbfce5bd0603efe125733f231381dcbb3c93d45873d98fec6d5a81e0acda9c9ac58987
SSDEEP

6144:hHexpX96XD2kn+sBra33pPUz147sLV6X6QXJT2:hUXoTtH5YiB47OsXdXJT2

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral2/memory/4676-133-0x0000000010000000-0x00000000100B8000-memory.dmp	family_blackmoon

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4676-133-0x0000000010000000-0x00000000100B8000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 4676	2836	rundll32.exe	79
PID 2836 wrote to memory of 4676	2836	rundll32.exe	79
PID 2836 wrote to memory of 4676	2836	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21091e6d7989c86c6f898a6b3d024d62cfb7c075e4c6f347e6db5f81e107143d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\21091e6d7989c86c6f898a6b3d024d62cfb7c075e4c6f347e6db5f81e107143d.dll,#1
  2⤵
  PID:4676

memory/4676-133-0x0000000010000000-0x00000000100B8000-memory.dmp

Filesize
736KB

Download