blackmoon | 7a8a646686c8d0724ddfbbb6fee290a715cdef3d175c6d68d0d8426c314af9c2

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16-06-2023 05:42

Target

7a8a646686c8d0724ddfbbb6fee290a715cdef3d175c6d68d0d8426c314af9c2.exe
Size

4.3MB
MD5

5d0e87871d554bdb153eb75b0720f729
SHA1

96db1dc26cd26f328654f1e8b030ec5b6b0af42a
SHA256

7a8a646686c8d0724ddfbbb6fee290a715cdef3d175c6d68d0d8426c314af9c2
SHA512

98f7cf7e5d15996e172417a10234482e440a36bcbe8b7e27de311f7ac3faa0c3f30d9d5e7656d494ca2469444973b1c4ce2aa23bccaab8a3dd490a733aaab29b
SSDEEP

98304:x7fqJV1f69j2Sqija0KnO+mgmCeYOv7bmZygiXbrUP:1qYRja04mglKbmZNKrUP

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4684-136-0x0000000002AA0000-0x0000000002ADC000-memory.dmp	family_blackmoon
behavioral2/memory/4684-134-0x0000000000400000-0x0000000000C3F000-memory.dmp	family_blackmoon

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4684-133-0x0000000003850000-0x0000000003D22000-memory.dmp	upx

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
2636	4684	WerFault.exe	7a8a646686c8d0724ddfbbb6fee290a715cdef3d175c6d68d0d8426c314af9c2.exe
3868	4684	WerFault.exe	7a8a646686c8d0724ddfbbb6fee290a715cdef3d175c6d68d0d8426c314af9c2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

7a8a646686c8d0724ddfbbb6fee290a715cdef3d175c6d68d0d8426c314af9c2.exe

pid	process
4684	7a8a646686c8d0724ddfbbb6fee290a715cdef3d175c6d68d0d8426c314af9c2.exe
4684	7a8a646686c8d0724ddfbbb6fee290a715cdef3d175c6d68d0d8426c314af9c2.exe

C:\Users\Admin\AppData\Local\Temp\7a8a646686c8d0724ddfbbb6fee290a715cdef3d175c6d68d0d8426c314af9c2.exe
"C:\Users\Admin\AppData\Local\Temp\7a8a646686c8d0724ddfbbb6fee290a715cdef3d175c6d68d0d8426c314af9c2.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 624
  2⤵
  - Program crash
  PID:2636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 640
  2⤵
  - Program crash
  PID:3868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4684 -ip 4684
1⤵
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4684 -ip 4684
1⤵
PID:4788

memory/4684-133-0x0000000003850000-0x0000000003D22000-memory.dmp

Filesize
4.8MB

Download
memory/4684-135-0x0000000010000000-0x0000000010059000-memory.dmp

Filesize
356KB

Download
memory/4684-137-0x0000000001390000-0x0000000001391000-memory.dmp

Filesize
4KB

Download
memory/4684-136-0x0000000002AA0000-0x0000000002ADC000-memory.dmp

Filesize
240KB

Download
memory/4684-134-0x0000000000400000-0x0000000000C3F000-memory.dmp

Filesize
8.2MB

Download
memory/4684-138-0x0000000002F30000-0x0000000003020000-memory.dmp

Filesize
960KB

Download
memory/4684-139-0x00000000036A0000-0x0000000003843000-memory.dmp

Filesize
1.6MB

Download
memory/4684-140-0x0000000003480000-0x0000000003695000-memory.dmp

Filesize
2.1MB

Download