blackmoon | 0180ff660a7ec9d3b779ccfad95574e4733e5295e4b87c2fbd680bc6605ec578

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22-02-2023 18:46

Target

0180ff660a7ec9d3b779ccfad95574e4733e5295e4b87c2fbd680bc6605ec578.dll
Size

1.7MB
MD5

aec39486edec830e24e5776a851dfc61
SHA1

9188afbcde535ffbea2938d70fde467c2061046d
SHA256

0180ff660a7ec9d3b779ccfad95574e4733e5295e4b87c2fbd680bc6605ec578
SHA512

d713f79da34153aebcdf41b675f4709485a16394d2a35a6f14488fec1326ec90c1a993a50439bfd5a35ed6142a453d0bd2d32e7175563a2b519895bf3d6a6b2d
SSDEEP

24576:kNoPvgBvuxzIIiCSJYkpZd2B9wdJKQEbFvZDQ2C9dr5Hdj4yM28Vqwo7Z:45qzLiCSSLBC9Sk2CnrBjobo

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1496-54-0x0000000010000000-0x0000000010518000-memory.dmp	family_blackmoon

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1496 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1496 rundll32.exe

flow	pid	process
2	1496	rundll32.exe

pid	process
1496	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 912 wrote to memory of 1496	912	rundll32.exe	rundll32.exe
PID 912 wrote to memory of 1496	912	rundll32.exe	rundll32.exe
PID 912 wrote to memory of 1496	912	rundll32.exe	rundll32.exe
PID 912 wrote to memory of 1496	912	rundll32.exe	rundll32.exe
PID 912 wrote to memory of 1496	912	rundll32.exe	rundll32.exe
PID 912 wrote to memory of 1496	912	rundll32.exe	rundll32.exe
PID 912 wrote to memory of 1496	912	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0180ff660a7ec9d3b779ccfad95574e4733e5295e4b87c2fbd680bc6605ec578.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:912

memory/1496-54-0x0000000010000000-0x0000000010518000-memory.dmp

Filesize
5.1MB

Download
memory/1496-55-0x00000000000B0000-0x00000000000B3000-memory.dmp

Filesize
12KB

Download