blackmoon | 3dd7f8db8a449765b1e0932394a1b310229ad492ca943ab396fa8d709446dfa9

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01-06-2023 16:33

Target

01178199.dll
Size

113KB
MD5

82414dead2dfee972e3943c9e26738bc
SHA1

0a77ce21a5e3697e805630953b73911f562ff1b2
SHA256

3dd7f8db8a449765b1e0932394a1b310229ad492ca943ab396fa8d709446dfa9
SHA512

75dd77f3a123203196b968449316281518155d77a48ba26dd4d6fcdcfb358e40c102ec519b992db6e74343712cc361d87b0c7d6dac8ca9a761e47b0089ee8c67
SSDEEP

1536:DooBspOAAkGafox1bZoFcbxM+ebZz+x4X5IPFmSpvXkWfCxaIK7VDIc9Vb:DTB2AkvoiW++ebZcGcmgvXkcC7K7K6F

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1440-54-0x00000000001B0000-0x00000000001C7000-memory.dmp	family_blackmoon

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1408 wrote to memory of 1440	1408	rundll32.exe	rundll32.exe
PID 1408 wrote to memory of 1440	1408	rundll32.exe	rundll32.exe
PID 1408 wrote to memory of 1440	1408	rundll32.exe	rundll32.exe
PID 1408 wrote to memory of 1440	1408	rundll32.exe	rundll32.exe
PID 1408 wrote to memory of 1440	1408	rundll32.exe	rundll32.exe
PID 1408 wrote to memory of 1440	1408	rundll32.exe	rundll32.exe
PID 1408 wrote to memory of 1440	1408	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01178199.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1408

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01178199.dll,#1
2⤵
PID:1440

memory/1440-54-0x00000000001B0000-0x00000000001C7000-memory.dmp

Filesize
92KB

Download