blackmoon | a99fdfcac882552f54c15b85e26aacf90443e0a437f39f71c3c020b42ae03e45

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08-06-2023 19:59

Target

a99fdfcac882552f54c15b85e26aacf90443e0a437f39f71c3c020b42ae03e45.dll
Size

1.7MB
MD5

6615a9ca524285e7f48f5f5e9db49a70
SHA1

4960ad73fc72985f8889b65174ee73e5ac803a27
SHA256

a99fdfcac882552f54c15b85e26aacf90443e0a437f39f71c3c020b42ae03e45
SHA512

2c418e853d00479b151ecd21264369d86c1f2e1cfcaa12a6f205c0b484978148202d20e1857d3fd215cb2eeaedd0cd129bf2910c99149f6de6941caeea28c2b9
SSDEEP

49152:uG7cnE+5/dLENM3Wgt22Em3UuCi9TIxZI:uG7cEU/RxGgtlEmk29Ig

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1740-54-0x0000000010000000-0x000000001051F000-memory.dmp	family_blackmoon

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1740 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1740 rundll32.exe

flow	pid	process
2	1740	rundll32.exe

pid	process
1740	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1728 wrote to memory of 1740	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1740	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1740	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1740	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1740	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1740	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1740	1728	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a99fdfcac882552f54c15b85e26aacf90443e0a437f39f71c3c020b42ae03e45.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728

memory/1740-54-0x0000000010000000-0x000000001051F000-memory.dmp

Filesize
5.1MB

Download
memory/1740-55-0x00000000000C0000-0x00000000000C3000-memory.dmp

Filesize
12KB

Download