blackmoon | 1ea550dc522c591981333122ab79bfcc7dc75f4b566d9c7e69d3de8ad8922e1c

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2023 20:15

Target

1ea550dc522c591981333122ab79bfcc7dc75f4b566d9c7e69d3de8ad8922e1c.dll
Size

1.7MB
MD5

8517eb670b4b169841cc95637010c7aa
SHA1

2da5d0ce61f958b41e86359ddb6206dc76e67e98
SHA256

1ea550dc522c591981333122ab79bfcc7dc75f4b566d9c7e69d3de8ad8922e1c
SHA512

00ec817043125ed9bb087f1d61646a580eae6bb4df8245a403da4a79549a077b62257f3987d1285555e342f6dbf009449e4b0e98d3762fb41cfa39032d5bfa37
SSDEEP

49152:eAtcJOLNVge7J9/dJIdkdCaNrWM3CQO7BVeYcmwCgD:cJENVl7J9Fykd5rWM2BVklCg

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1484-133-0x0000000010000000-0x000000001051C000-memory.dmp	family_blackmoon

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

7 1484 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1484 rundll32.exe

flow	pid	process
7	1484	rundll32.exe

pid	process
1484	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1400 wrote to memory of 1484	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1484	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1484	1400	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ea550dc522c591981333122ab79bfcc7dc75f4b566d9c7e69d3de8ad8922e1c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400

memory/1484-133-0x0000000010000000-0x000000001051C000-memory.dmp

Filesize
5.1MB

Download
memory/1484-134-0x0000000000B70000-0x0000000000B73000-memory.dmp

Filesize
12KB

Download