blackmoon | c9ac46d8ae78dfeae3635019b3b191079fcd5ad6830821a30b0a60345b0aaaca

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
18-05-2023 19:35

Target

c9ac46d8ae78dfeae3635019b3b191079fcd5ad6830821a30b0a60345b0aaaca.dll
Size

1.7MB
MD5

b75deef48a7ef28fae267b3a2313ed18
SHA1

b94a7050ca6f7f9b8ff4a70febcc7a450f2871ce
SHA256

c9ac46d8ae78dfeae3635019b3b191079fcd5ad6830821a30b0a60345b0aaaca
SHA512

16ef34580b649e001cd70e4eefedc5999860070cdefc5bc9c37cda9634faa639766c3c8b2f7b122f6ba844c3bab37b5a324ca96941e8e731e06efc900b6fc77b
SSDEEP

49152:KyLbFmE4vp0nBP9cxe0qTfkdj5L0OCupEI9+30oEPY:tLbFmE4R0nbtdy5L0be1oE

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1692-54-0x0000000010000000-0x000000001051F000-memory.dmp	family_blackmoon

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1692 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1692 rundll32.exe

flow	pid	process
2	1692	rundll32.exe

pid	process
1692	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1392 wrote to memory of 1692	1392	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 1692	1392	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 1692	1392	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 1692	1392	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 1692	1392	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 1692	1392	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 1692	1392	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9ac46d8ae78dfeae3635019b3b191079fcd5ad6830821a30b0a60345b0aaaca.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1392

memory/1692-54-0x0000000010000000-0x000000001051F000-memory.dmp

Filesize
5.1MB

Download
memory/1692-55-0x00000000000B0000-0x00000000000B3000-memory.dmp

Filesize
12KB

Download