blackmoon | e351bad76010c896ccdcb5fcd7e5d1ebe0cb767cd70227ec028dfd2d1fd99ba7

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08-06-2023 19:17

Target

e351bad76010c896ccdcb5fcd7e5d1ebe0cb767cd70227ec028dfd2d1fd99ba7.dll
Size

1.5MB
MD5

cfc0e70f53511cdd4bb236e9ebcc692c
SHA1

a218e791f5cdafcf33c59f9386f36b2846da8547
SHA256

e351bad76010c896ccdcb5fcd7e5d1ebe0cb767cd70227ec028dfd2d1fd99ba7
SHA512

863c64a537f68212b0527b9fb5b2462353a264993b9eb9a5b0a19eb5b67e53804cf015814bcc3ca61aa6dfa2cb03b3f55a2fbe582009217f6d96ba34f54eabae
SSDEEP

24576:HJizxbQGs2xeDZHembNnZmYOOV2jMQP2xV/1CP2kDjgPCSaKBCLiJphqzsghami:HMzxURwo+mb2Y32jMQs/1C9jgqSaKB68

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1328-54-0x0000000010000000-0x0000000010406000-memory.dmp	family_blackmoon

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1328 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1328 rundll32.exe

flow	pid	process
2	1328	rundll32.exe

pid	process
1328	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1064 wrote to memory of 1328	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1328	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1328	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1328	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1328	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1328	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1328	1064	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e351bad76010c896ccdcb5fcd7e5d1ebe0cb767cd70227ec028dfd2d1fd99ba7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1064

memory/1328-54-0x0000000010000000-0x0000000010406000-memory.dmp

Filesize
4.0MB

Download
memory/1328-55-0x00000000000B0000-0x00000000000B3000-memory.dmp

Filesize
12KB

Download