blackmoon | ca388b80226de2bee6c5d795b7905df43f9bac1c9495cfc64895efdb0a1b9e48

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11-06-2023 08:34

Target

07405699.exe
Size

353KB
MD5

86373fa12d889bf88d9df2c8d7d897f3
SHA1

4f90bb791c1d5e2332c5346dede176eedbc0dd9a
SHA256

ca388b80226de2bee6c5d795b7905df43f9bac1c9495cfc64895efdb0a1b9e48
SHA512

d2588db478b4d7e0c3245be40559ec580f4216eb6233a6d7011ccb27170d1e64987ccb6e74f99592bb66fd589b317bd49cd625aa9c61d3bda131cef83aff5184
SSDEEP

6144:yBzIWlTK/SysJoYL2O5NeSPL0LzNjR8KAARdYM09rCFrPyd7ECQtEOd9b5sFjVfL:yZlewoO5V0LMJAnsrcy0t5d9b5gjVfQg

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1724-54-0x0000000000400000-0x000000000063B000-memory.dmp	family_blackmoon

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1724-54-0x0000000000400000-0x000000000063B000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

07405699.exe

pid process

1724 07405699.exe

pid	process
1724	07405699.exe

C:\Users\Admin\AppData\Local\Temp\07405699.exe
"C:\Users\Admin\AppData\Local\Temp\07405699.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1724

memory/1724-54-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/1724-55-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download