blackmoon | af67c7d2f341ced9a4ecf88d2d736d9e34c9292c1b2a276f6067bb7e9ebfe92b

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08-06-2023 20:00

Target

af67c7d2f341ced9a4ecf88d2d736d9e34c9292c1b2a276f6067bb7e9ebfe92b.dll
Size

1.7MB
MD5

9eeb8f7487522c7bbc387c0f41285a8f
SHA1

8fc463f78caea8b4ca98c1cdaca9f7113bffc00b
SHA256

af67c7d2f341ced9a4ecf88d2d736d9e34c9292c1b2a276f6067bb7e9ebfe92b
SHA512

2c9f189f3e2c7db2ae6ef1ea78162d11ac7c5280b4a66b29d452a547ed33d07e1766b56c9527972cc5d82d3881e7adf33fc1a8b6e370f8c6074c9620b6859801
SSDEEP

49152:vlOj7TXgufTZNgITbOYbGullnlfTZ8MIKswkY+YZBR3T7wR:EbLHgIOYXnlbZnIKA/WD3Ty

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/936-54-0x0000000010000000-0x00000000104A4000-memory.dmp	family_blackmoon

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 936 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

936 rundll32.exe

flow	pid	process
2	936	rundll32.exe

pid	process
936	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2032 wrote to memory of 936	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 936	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 936	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 936	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 936	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 936	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 936	2032	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af67c7d2f341ced9a4ecf88d2d736d9e34c9292c1b2a276f6067bb7e9ebfe92b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032

memory/936-54-0x0000000010000000-0x00000000104A4000-memory.dmp

Filesize
4.6MB

Download
memory/936-55-0x00000000000B0000-0x00000000000B3000-memory.dmp

Filesize
12KB

Download