blackmoon | d573bfc4f8016b5762aac81d5ea2c1fbcd402d70139482fc9b3e19daf3800e03

Analysis

max time kernel
31s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22-02-2023 18:59

Target

d573bfc4f8016b5762aac81d5ea2c1fbcd402d70139482fc9b3e19daf3800e03.dll
Size

1.4MB
MD5

19e6817b2fa1bae0e9e7cca721549835
SHA1

91b66dd16e72111b478767ae0e5837988f50166b
SHA256

d573bfc4f8016b5762aac81d5ea2c1fbcd402d70139482fc9b3e19daf3800e03
SHA512

998adf86dd8380b8fc3daf28328e369e06fbeb30ecdc91650880d01549c971e3cf4613e5806345672c3acd59376e65e63437f201a8bd70b17013d2a6e24c3f32
SSDEEP

24576:EWaBswTAEoKwlTD82CJy4VInpmVCfixrWxITZHCALkl4Njkiu2XOx2jo7dmPtzPD:+BsUAEvw435VInksQoIdHCkdG2X1oJCc

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1304-54-0x0000000010000000-0x00000000103C5000-memory.dmp	family_blackmoon

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

4 1304 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1304 rundll32.exe

flow	pid	process
4	1304	rundll32.exe

pid	process
1304	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1736 wrote to memory of 1304	1736	rundll32.exe	rundll32.exe
PID 1736 wrote to memory of 1304	1736	rundll32.exe	rundll32.exe
PID 1736 wrote to memory of 1304	1736	rundll32.exe	rundll32.exe
PID 1736 wrote to memory of 1304	1736	rundll32.exe	rundll32.exe
PID 1736 wrote to memory of 1304	1736	rundll32.exe	rundll32.exe
PID 1736 wrote to memory of 1304	1736	rundll32.exe	rundll32.exe
PID 1736 wrote to memory of 1304	1736	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d573bfc4f8016b5762aac81d5ea2c1fbcd402d70139482fc9b3e19daf3800e03.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736

memory/1304-54-0x0000000010000000-0x00000000103C5000-memory.dmp

Filesize
3.8MB

Download
memory/1304-55-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download