blackmoon | 10a3e8a8dafbe4ad4c712c4764c00a3b77128ebf6ed5d07ab17e6fd8b0412e3b

Analysis

max time kernel
82s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2023 19:55

Target

10a3e8a8dafbe4ad4c712c4764c00a3b77128ebf6ed5d07ab17e6fd8b0412e3b.dll
Size

1.4MB
MD5

83ecd6c381face0dc42d7c450ec61bbe
SHA1

1609198d41fcaf2b69a3b126e2a58ade00ac337c
SHA256

10a3e8a8dafbe4ad4c712c4764c00a3b77128ebf6ed5d07ab17e6fd8b0412e3b
SHA512

736150baf6dc455ca273e20da04e5abee8c0c96105f8ca322d22ce8dfd73371954e6f789a38dd9170114311606df3db0350333a0c5cc8dea59688a585be45ac9
SSDEEP

24576:VdE32rayrmcTNzaLeVCljLJyNSjUebHmokrm6q91NOQ+nNettO+bGJh+90VuDDv:VGuDmc4UAUsJ7mtlK+NNePbbGJhRVE

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4636-133-0x0000000010000000-0x00000000103C5000-memory.dmp	family_blackmoon

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

6 4636 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

4636 rundll32.exe

flow	pid	process
6	4636	rundll32.exe

pid	process
4636	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4760 wrote to memory of 4636	4760	rundll32.exe	rundll32.exe
PID 4760 wrote to memory of 4636	4760	rundll32.exe	rundll32.exe
PID 4760 wrote to memory of 4636	4760	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\10a3e8a8dafbe4ad4c712c4764c00a3b77128ebf6ed5d07ab17e6fd8b0412e3b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4760

memory/4636-133-0x0000000010000000-0x00000000103C5000-memory.dmp

Filesize
3.8MB

Download
memory/4636-134-0x00000000003F0000-0x00000000003F3000-memory.dmp

Filesize
12KB

Download