blackmoon | b466d3d2d6a08eae5035f6e74ba11b8dbb99803b2f54116312084dcc47629db3

Analysis

max time kernel
147s
max time network
152s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 08:23

Target

b466d3d2d6a08eae5035f6e74ba11b8dbb99803b2f54116312084dcc47629db3.dll
Size

80KB
MD5

f95587b302a78ea56796a26d57a7f205
SHA1

3d13fd676fe2401d0d3376d775a39130b15c5883
SHA256

b466d3d2d6a08eae5035f6e74ba11b8dbb99803b2f54116312084dcc47629db3
SHA512

71e709d4c7bc10d0b853af73e0a99a532d7a30f54c4801c0d1db66b223594adb901471c4bed46320fce0586c7affe792c890e5cdaa255ee177e52c6086c77506
SSDEEP

768:hmvT5hPKXIm//39QqUCaNadrsa2sI5ccdmGLkiGuWxZ:OH5m/P9xUCDdrV2s9QZ4xZ

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

resource	yara_rule
behavioral1/memory/928-56-0x0000000010000000-0x0000000010014000-memory.dmp	family_blackmoon
behavioral1/memory/928-57-0x0000000010000000-0x0000000010014000-memory.dmp	family_blackmoon

Blocklisted process makes network request 3 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 928	992	rundll32.exe	27
PID 992 wrote to memory of 928	992	rundll32.exe	27
PID 992 wrote to memory of 928	992	rundll32.exe	27
PID 992 wrote to memory of 928	992	rundll32.exe	27
PID 992 wrote to memory of 928	992	rundll32.exe	27
PID 992 wrote to memory of 928	992	rundll32.exe	27
PID 992 wrote to memory of 928	992	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b466d3d2d6a08eae5035f6e74ba11b8dbb99803b2f54116312084dcc47629db3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b466d3d2d6a08eae5035f6e74ba11b8dbb99803b2f54116312084dcc47629db3.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:928

memory/928-55-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download
memory/928-56-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/928-57-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download