blackmoon | a8f074d0f1dd7a1c61dd5aec5856bf404fae4f38e93eeb05a8fe691f012daaa4

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13-03-2023 15:07

Target

a8f074d0f1dd7a1c61dd5aec5856bf404fae4f38e93eeb05a8fe691f012daaa4.dll
Size

117KB
MD5

44160dd35999d7cb0eaf15f8c3f6ac14
SHA1

1a454b460bbb1fb74be58c3d6402469fdea15a3e
SHA256

a8f074d0f1dd7a1c61dd5aec5856bf404fae4f38e93eeb05a8fe691f012daaa4
SHA512

b907840df609a98cb17b0f92a1dc16edb6210dfcfbaff98917fdb9d0cfc6288f5bb975d0e87cc479c95da48e1c3d1664e99a996d236e5209c414b7ba2d7420f2
SSDEEP

1536:wA/yfatLv5hjJ3uU86cz2K1CwAyjh7buyaqNIQGY2DwOoAtSfhd77ekaU07WJP:OatTJ+Uf45CxyWYKgAtSfz77+C

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1324-54-0x0000000010000000-0x000000001005D000-memory.dmp	family_blackmoon
behavioral1/memory/1324-56-0x0000000010000000-0x000000001005D000-memory.dmp	family_blackmoon
behavioral1/memory/1324-55-0x0000000010000000-0x000000001005D000-memory.dmp	family_blackmoon

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1212 wrote to memory of 1324	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 1324	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 1324	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 1324	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 1324	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 1324	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 1324	1212	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a8f074d0f1dd7a1c61dd5aec5856bf404fae4f38e93eeb05a8fe691f012daaa4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a8f074d0f1dd7a1c61dd5aec5856bf404fae4f38e93eeb05a8fe691f012daaa4.dll,#1
2⤵
PID:1324

memory/1324-54-0x0000000010000000-0x000000001005D000-memory.dmp

Filesize
372KB

Download
memory/1324-56-0x0000000010000000-0x000000001005D000-memory.dmp

Filesize
372KB

Download
memory/1324-55-0x0000000010000000-0x000000001005D000-memory.dmp

Filesize
372KB

Download
memory/1324-57-0x0000000002260000-0x00000000023E0000-memory.dmp

Filesize
1.5MB

Download
memory/1324-58-0x0000000002010000-0x0000000002120000-memory.dmp

Filesize
1.1MB

Download