blackmoon | b6199ff6e45cfde9e003ed2c09ce70627e5ed1b8cf31f6a6604160c6f1e624af

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10-06-2023 18:54

Target

b6199ff6e45cfde9e003ed2c09ce70627e5ed1b8cf31f6a6604160c6f1e624af.dll
Size

5.6MB
MD5

b3768755a7b8463a90737b996a9714b9
SHA1

b2cd42bbc7ae7841b62873250668ae2c7e1cef7a
SHA256

b6199ff6e45cfde9e003ed2c09ce70627e5ed1b8cf31f6a6604160c6f1e624af
SHA512

fe00024afd7e4c6e7cd2da126bba89de9602546ba1fd3da349126f4a515961ddbe393d683472b543e61dde9e439b1a44b6c301ef69a7cf1416b1beada467c66a
SSDEEP

98304:4qkglGZbjxa6ceSlQUaH90OfTb7czfzwfkZkVsvkA3Yju7pA/mRe0:4xglKxPcqUkeOfT3GcBVsLiIpxQ

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1236-54-0x0000000010000000-0x000000001095B000-memory.dmp	family_blackmoon

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

1 1236 rundll32.exe

flow	pid	process
1	1236	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1240 wrote to memory of 1236	1240	rundll32.exe	rundll32.exe
PID 1240 wrote to memory of 1236	1240	rundll32.exe	rundll32.exe
PID 1240 wrote to memory of 1236	1240	rundll32.exe	rundll32.exe
PID 1240 wrote to memory of 1236	1240	rundll32.exe	rundll32.exe
PID 1240 wrote to memory of 1236	1240	rundll32.exe	rundll32.exe
PID 1240 wrote to memory of 1236	1240	rundll32.exe	rundll32.exe
PID 1240 wrote to memory of 1236	1240	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6199ff6e45cfde9e003ed2c09ce70627e5ed1b8cf31f6a6604160c6f1e624af.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6199ff6e45cfde9e003ed2c09ce70627e5ed1b8cf31f6a6604160c6f1e624af.dll,#1
2⤵
- Blocklisted process makes network request
PID:1236

memory/1236-54-0x0000000010000000-0x000000001095B000-memory.dmp

Filesize
9.4MB

Download