blackmoon | b9b2bed64bcb122ad73a595e82cfe57982ff4aef13756ac287554c42268af4af

Analysis

max time kernel
29s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20-06-2023 21:01

Target

b9b2bed64bcb122ad73a595e82cfe57982ff4aef13756ac287554c42268af4af.dll
Size

1.4MB
MD5

7ff500c308bef438320e19dba723fd47
SHA1

f617104e96eeca193f65de477b2ea1ccda4ceda6
SHA256

b9b2bed64bcb122ad73a595e82cfe57982ff4aef13756ac287554c42268af4af
SHA512

9e8bbcedf5d2a6efc20c42fff233dbf25a879d4342e4b4f7ed081d4ef8b30cce1dc6e8a0310f1c139e8a0b8ae85e5c6b4d40f34dda3c46bf96f7e40e75c3134c
SSDEEP

24576:xWVRm9ou2PJvtoH5/eLaITlEtUdaU32914KGE0lMa:s7Du2Rv2/e+Ie7ac1Z0lMa

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1716-54-0x0000000010000000-0x0000000010408000-memory.dmp	family_blackmoon

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1716 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1716 rundll32.exe

flow	pid	process
2	1716	rundll32.exe

pid	process
1716	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2000 wrote to memory of 1716	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1716	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1716	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1716	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1716	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1716	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1716	2000	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9b2bed64bcb122ad73a595e82cfe57982ff4aef13756ac287554c42268af4af.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000

memory/1716-54-0x0000000010000000-0x0000000010408000-memory.dmp

Filesize
4.0MB

Download
memory/1716-55-0x0000000000120000-0x0000000000123000-memory.dmp

Filesize
12KB

Download