blackmoon | 001f73c3184ad7c382b85f673ea93fbaba932afa7d875bb651e00d64189a7aab

Analysis

max time kernel
68s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01-04-2023 19:22

Target

001f73c3184ad7c382b85f673ea93fbaba932afa7d875bb651e00d64189a7aab.dll
Size

1.4MB
MD5

5a5cf1ea8b62e7589d6474e652c36c1f
SHA1

d3438a695adaa1ba52b83ecac3944744829fee62
SHA256

001f73c3184ad7c382b85f673ea93fbaba932afa7d875bb651e00d64189a7aab
SHA512

84aa3da7a1dccce8ec9ab75ec2c4b8f229ed9371a0fb0997a0a207891bdc1a84062d6c180e23e1ca78349f0b97a1034cbc56bd6a5774003959241056cdfa1d92
SSDEEP

24576:rD8Bnow5qTF2xn0r4Wv2aHzt3VtxGc9BAUjkh7zhdl+3SutwSy9l65ZvdroKDvhr:X8BoMqx2xnu4cZdZ9rjuXI3PwSPZvDDl

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1416-133-0x0000000010000000-0x00000000103CB000-memory.dmp	family_blackmoon

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

7 1416 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1416 rundll32.exe

flow	pid	process
7	1416	rundll32.exe

pid	process
1416	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4196 wrote to memory of 1416	4196	rundll32.exe	rundll32.exe
PID 4196 wrote to memory of 1416	4196	rundll32.exe	rundll32.exe
PID 4196 wrote to memory of 1416	4196	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\001f73c3184ad7c382b85f673ea93fbaba932afa7d875bb651e00d64189a7aab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4196

memory/1416-133-0x0000000010000000-0x00000000103CB000-memory.dmp

Filesize
3.8MB

Download
memory/1416-134-0x00000000014A0000-0x00000000014A3000-memory.dmp

Filesize
12KB

Download