blackmoon | a63c796e09f7726d5e91e6d84267e7984dbd268fc0b37838bc1dda60fcf5a444

Analysis

max time kernel
161s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/11/2022, 23:53

Target

a63c796e09f7726d5e91e6d84267e7984dbd268fc0b37838bc1dda60fcf5a444.dll
Size

356KB
MD5

0c62551f9684a103dac30b13a1c392f0
SHA1

ff07d54f409fe54ff8d532f12b9f554b991cc63e
SHA256

a63c796e09f7726d5e91e6d84267e7984dbd268fc0b37838bc1dda60fcf5a444
SHA512

31b33fb72750d7fe452bef8967c32033522e25f1f36925492ca5640f0a08b92a9d90a223a5b7794367494b15a03083a2141f81c98d6dbab909f3691900c02e40
SSDEEP

6144:tHWao/MtE0rOcx0J1ypTuNBpXgi2QDh0ICLy8NoH1vszYDbuRLpqluWnXCW+mhsJ:1Wao/vU41ybE90dLGEzwSRQbQmhz2s2y

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral2/memory/3756-133-0x0000000010000000-0x00000000100C1000-memory.dmp	family_blackmoon

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/3756-133-0x0000000010000000-0x00000000100C1000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 3756	2248	rundll32.exe	79
PID 2248 wrote to memory of 3756	2248	rundll32.exe	79
PID 2248 wrote to memory of 3756	2248	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a63c796e09f7726d5e91e6d84267e7984dbd268fc0b37838bc1dda60fcf5a444.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a63c796e09f7726d5e91e6d84267e7984dbd268fc0b37838bc1dda60fcf5a444.dll,#1
  2⤵
  PID:3756

memory/3756-133-0x0000000010000000-0x00000000100C1000-memory.dmp

Filesize
772KB

Download