blackmoon | b743656146b1200bd138fc39e13595620a9d283736a17d4447c6126cbe247aa6

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 19:34

Target

b743656146b1200bd138fc39e13595620a9d283736a17d4447c6126cbe247aa6.dll
Size

694KB
MD5

09cdd279fa2e745dd0ed10da4306e1d0
SHA1

c3b69211ba2ebc3a7b0d9d05cfbd47ffa47f7fa6
SHA256

b743656146b1200bd138fc39e13595620a9d283736a17d4447c6126cbe247aa6
SHA512

8a5d2b63c2d79b8274c76bb64ff4adb03d310ea9094813989583b6eff361f86d05d66424dfe0862bab9955655f28be3d599ad679524dff9f8740c15514a01c8f
SSDEEP

12288:8EBx2PuZwxfFaCLkSAf6fB8IvGbPXyFdErxBpM+p81z1z53xsdL4v:8EmPuZQZI4BmbPC7Efprp81z11

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral2/memory/3444-135-0x00000000025D0000-0x00000000027DB000-memory.dmp	family_blackmoon

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3444	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 3444	1808	rundll32.exe	80
PID 1808 wrote to memory of 3444	1808	rundll32.exe	80
PID 1808 wrote to memory of 3444	1808	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b743656146b1200bd138fc39e13595620a9d283736a17d4447c6126cbe247aa6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b743656146b1200bd138fc39e13595620a9d283736a17d4447c6126cbe247aa6.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3444

memory/3444-133-0x00000000025D0000-0x00000000027DB000-memory.dmp

Filesize
2.0MB

Download
memory/3444-134-0x00000000025D0000-0x00000000027DB000-memory.dmp

Filesize
2.0MB

Download
memory/3444-135-0x00000000025D0000-0x00000000027DB000-memory.dmp

Filesize
2.0MB

Download