blackmoon | 1ea550dc522c591981333122ab79bfcc7dc75f4b566d9c7e69d3de8ad8922e1c

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11-04-2023 20:15

Target

1ea550dc522c591981333122ab79bfcc7dc75f4b566d9c7e69d3de8ad8922e1c.dll
Size

1.7MB
MD5

8517eb670b4b169841cc95637010c7aa
SHA1

2da5d0ce61f958b41e86359ddb6206dc76e67e98
SHA256

1ea550dc522c591981333122ab79bfcc7dc75f4b566d9c7e69d3de8ad8922e1c
SHA512

00ec817043125ed9bb087f1d61646a580eae6bb4df8245a403da4a79549a077b62257f3987d1285555e342f6dbf009449e4b0e98d3762fb41cfa39032d5bfa37
SSDEEP

49152:eAtcJOLNVge7J9/dJIdkdCaNrWM3CQO7BVeYcmwCgD:cJENVl7J9Fykd5rWM2BVklCg

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1788-54-0x0000000010000000-0x000000001051C000-memory.dmp	family_blackmoon

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1788 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1788 rundll32.exe

flow	pid	process
2	1788	rundll32.exe

pid	process
1788	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1320 wrote to memory of 1788	1320	rundll32.exe	rundll32.exe
PID 1320 wrote to memory of 1788	1320	rundll32.exe	rundll32.exe
PID 1320 wrote to memory of 1788	1320	rundll32.exe	rundll32.exe
PID 1320 wrote to memory of 1788	1320	rundll32.exe	rundll32.exe
PID 1320 wrote to memory of 1788	1320	rundll32.exe	rundll32.exe
PID 1320 wrote to memory of 1788	1320	rundll32.exe	rundll32.exe
PID 1320 wrote to memory of 1788	1320	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ea550dc522c591981333122ab79bfcc7dc75f4b566d9c7e69d3de8ad8922e1c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1320

memory/1788-54-0x0000000010000000-0x000000001051C000-memory.dmp

Filesize
5.1MB

Download
memory/1788-55-0x0000000000140000-0x0000000000143000-memory.dmp

Filesize
12KB

Download