blackmoon | 9eb4725043fb10627b7f57160a7d14eda203ddd4ac4d713d55d9eba78f640e96

Analysis

max time kernel
102s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2023 07:01

Target

9eb4725043fb10627b7f57160a7d14eda203ddd4ac4d713d55d9eba78f640e96.dll
Size

5.9MB
MD5

c137497f83cca78dbc03f8b6cd77936b
SHA1

203cf3522d61c4e3f5b98209509c875e4be529fc
SHA256

9eb4725043fb10627b7f57160a7d14eda203ddd4ac4d713d55d9eba78f640e96
SHA512

2657ac955a3c714c4e60acf8450acd223b235f5cca55e03a695641f3c0db4e8a7784f53b712854c7b8d76b18ab7505e66a5e37f7157ba9d376b8e4000b0bbaab
SSDEEP

98304:wiPDC+kAE9KBSzqiNoEqmSCG02GYG1MqvMYfVCetV6EY04:prnkJkTiNyG2Gd1McQelYv

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3724-133-0x0000000010000000-0x00000000100B4000-memory.dmp	family_blackmoon

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2984 wrote to memory of 3724	2984	rundll32.exe	rundll32.exe
PID 2984 wrote to memory of 3724	2984	rundll32.exe	rundll32.exe
PID 2984 wrote to memory of 3724	2984	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9eb4725043fb10627b7f57160a7d14eda203ddd4ac4d713d55d9eba78f640e96.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9eb4725043fb10627b7f57160a7d14eda203ddd4ac4d713d55d9eba78f640e96.dll,#1
2⤵
PID:3724

memory/3724-133-0x0000000010000000-0x00000000100B4000-memory.dmp

Filesize
720KB

Download