blackmoon | 001f73c3184ad7c382b85f673ea93fbaba932afa7d875bb651e00d64189a7aab

Analysis

max time kernel
32s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01-04-2023 19:22

Target

001f73c3184ad7c382b85f673ea93fbaba932afa7d875bb651e00d64189a7aab.dll
Size

1.4MB
MD5

5a5cf1ea8b62e7589d6474e652c36c1f
SHA1

d3438a695adaa1ba52b83ecac3944744829fee62
SHA256

001f73c3184ad7c382b85f673ea93fbaba932afa7d875bb651e00d64189a7aab
SHA512

84aa3da7a1dccce8ec9ab75ec2c4b8f229ed9371a0fb0997a0a207891bdc1a84062d6c180e23e1ca78349f0b97a1034cbc56bd6a5774003959241056cdfa1d92
SSDEEP

24576:rD8Bnow5qTF2xn0r4Wv2aHzt3VtxGc9BAUjkh7zhdl+3SutwSy9l65ZvdroKDvhr:X8BoMqx2xnu4cZdZ9rjuXI3PwSPZvDDl

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1732-54-0x0000000010000000-0x00000000103CB000-memory.dmp	family_blackmoon

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1732 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1732 rundll32.exe

flow	pid	process
2	1732	rundll32.exe

pid	process
1732	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1308 wrote to memory of 1732	1308	rundll32.exe	rundll32.exe
PID 1308 wrote to memory of 1732	1308	rundll32.exe	rundll32.exe
PID 1308 wrote to memory of 1732	1308	rundll32.exe	rundll32.exe
PID 1308 wrote to memory of 1732	1308	rundll32.exe	rundll32.exe
PID 1308 wrote to memory of 1732	1308	rundll32.exe	rundll32.exe
PID 1308 wrote to memory of 1732	1308	rundll32.exe	rundll32.exe
PID 1308 wrote to memory of 1732	1308	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\001f73c3184ad7c382b85f673ea93fbaba932afa7d875bb651e00d64189a7aab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1308

memory/1732-54-0x0000000010000000-0x00000000103CB000-memory.dmp

Filesize
3.8MB

Download
memory/1732-55-0x00000000000B0000-0x00000000000B3000-memory.dmp

Filesize
12KB

Download