blackmoon | b743656146b1200bd138fc39e13595620a9d283736a17d4447c6126cbe247aa6

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 19:34

Target

b743656146b1200bd138fc39e13595620a9d283736a17d4447c6126cbe247aa6.dll
Size

694KB
MD5

09cdd279fa2e745dd0ed10da4306e1d0
SHA1

c3b69211ba2ebc3a7b0d9d05cfbd47ffa47f7fa6
SHA256

b743656146b1200bd138fc39e13595620a9d283736a17d4447c6126cbe247aa6
SHA512

8a5d2b63c2d79b8274c76bb64ff4adb03d310ea9094813989583b6eff361f86d05d66424dfe0862bab9955655f28be3d599ad679524dff9f8740c15514a01c8f
SSDEEP

12288:8EBx2PuZwxfFaCLkSAf6fB8IvGbPXyFdErxBpM+p81z1z53xsdL4v:8EmPuZQZI4BmbPC7Efprp81z11

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 3 IoCs

resource	yara_rule
behavioral1/memory/544-56-0x0000000002060000-0x000000000226B000-memory.dmp	family_blackmoon
behavioral1/memory/544-57-0x0000000002060000-0x000000000226B000-memory.dmp	family_blackmoon
behavioral1/memory/544-59-0x0000000002060000-0x000000000226B000-memory.dmp	family_blackmoon

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
544	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1160	544	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 544	2036	rundll32.exe	26
PID 2036 wrote to memory of 544	2036	rundll32.exe	26
PID 2036 wrote to memory of 544	2036	rundll32.exe	26
PID 2036 wrote to memory of 544	2036	rundll32.exe	26
PID 2036 wrote to memory of 544	2036	rundll32.exe	26
PID 2036 wrote to memory of 544	2036	rundll32.exe	26
PID 2036 wrote to memory of 544	2036	rundll32.exe	26
PID 544 wrote to memory of 1160	544	rundll32.exe	27
PID 544 wrote to memory of 1160	544	rundll32.exe	27
PID 544 wrote to memory of 1160	544	rundll32.exe	27
PID 544 wrote to memory of 1160	544	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b743656146b1200bd138fc39e13595620a9d283736a17d4447c6126cbe247aa6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b743656146b1200bd138fc39e13595620a9d283736a17d4447c6126cbe247aa6.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 256
    3⤵
    - Program crash
    PID:1160

memory/544-55-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/544-56-0x0000000002060000-0x000000000226B000-memory.dmp

Filesize
2.0MB

Download
memory/544-57-0x0000000002060000-0x000000000226B000-memory.dmp

Filesize
2.0MB

Download
memory/544-59-0x0000000002060000-0x000000000226B000-memory.dmp

Filesize
2.0MB

Download