blackmoon | fca0368e45dfb97bb4d472f3e24b72e0fd833bfc98144d759975bd5dbec94787

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12-04-2023 18:39

Target

fca0368e45dfb97bb4d472f3e24b72e0fd833bfc98144d759975bd5dbec94787.dll
Size

1.4MB
MD5

996a4eff33c91fe76323f1d5a5ec4726
SHA1

555c59601dd694a0cfbca1f24284b7b1d41f2bbf
SHA256

fca0368e45dfb97bb4d472f3e24b72e0fd833bfc98144d759975bd5dbec94787
SHA512

4b1807ba9e516de025e5a298435149b96a07cbdb4ca3f1a1f80d501dbbad2e84be83e456c79289c784f3647f96cffa649549deaf7e26b25441c6bcb98e31dba0
SSDEEP

24576:Wb3rZGW4IXH8cUuMA2K0IO2SLh20xU4WWGBckJmnj1eTf4PX7Q1dXD3z0HCykDlf:WvZR79kok20xmWGB9mnRwgPEnz0iyaIc

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1316-54-0x0000000010000000-0x0000000010404000-memory.dmp	family_blackmoon

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1316 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1316 rundll32.exe

flow	pid	process
2	1316	rundll32.exe

pid	process
1316	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1244 wrote to memory of 1316	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 1316	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 1316	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 1316	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 1316	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 1316	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 1316	1244	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fca0368e45dfb97bb4d472f3e24b72e0fd833bfc98144d759975bd5dbec94787.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1244

memory/1316-54-0x0000000010000000-0x0000000010404000-memory.dmp

Filesize
4.0MB

Download
memory/1316-55-0x00000000000B0000-0x00000000000B3000-memory.dmp

Filesize
12KB

Download