blackmoon | 4f54a3780a64d223a88b01ecc5e7c173499cc8ac3b7669b76cc0be2fe6caab61

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23-05-2023 21:07

Target

4f54a3780a64d223a88b01ecc5e7c173499cc8ac3b7669b76cc0be2fe6caab61.dll
Size

1.5MB
MD5

9d8559caae84e5749c10f1af5d60f0c9
SHA1

dc849346c6f0d901e5888a4ea7462359122dae56
SHA256

4f54a3780a64d223a88b01ecc5e7c173499cc8ac3b7669b76cc0be2fe6caab61
SHA512

9ba1e2a86bde1ac82c7d4ba942c6c0acc24be6cc0e1255e9181a8424f8c985be89e6ca6ea276300e07fbd146aa2b224a7fe64d491a78b89052d9569bffae9e37
SSDEEP

24576:qjWZ8YgNwFLe/C7T+8mCeDIC3Vd2cTMoPcb8kOf1RkA/BlKyN70DF1:qwtgNQLam+8L+IYwcgvb8kOfU0nKv

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1328-54-0x0000000010000000-0x00000000103CA000-memory.dmp	family_blackmoon

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1328 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1328 rundll32.exe

flow	pid	process
2	1328	rundll32.exe

pid	process
1328	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1064 wrote to memory of 1328	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1328	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1328	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1328	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1328	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1328	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1328	1064	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f54a3780a64d223a88b01ecc5e7c173499cc8ac3b7669b76cc0be2fe6caab61.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1064

memory/1328-54-0x0000000010000000-0x00000000103CA000-memory.dmp

Filesize
3.8MB

Download
memory/1328-55-0x00000000000B0000-0x00000000000B3000-memory.dmp

Filesize
12KB

Download