blackmoon | 9fa8ec7d36557b191e63f4b5a73d4ae0d7fb4b84e148a328be51f5031e4e03fc

Analysis

max time kernel
135s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2023 21:04

Target

9fa8ec7d36557b191e63f4b5a73d4ae0d7fb4b84e148a328be51f5031e4e03fc.dll
Size

1.4MB
MD5

869c43216a6c86185d7f9a267d13fdc6
SHA1

b2026f4bbd159decdda9d35a2ab5de2df5db41e3
SHA256

9fa8ec7d36557b191e63f4b5a73d4ae0d7fb4b84e148a328be51f5031e4e03fc
SHA512

7fddd15cdfdfbeed839b44fc4537ea3fb9ad3aa32cf5705ae15a86228e7209fdedb7d218526b465904f33d756064772bb81247dac585d8ba90a1a4a3e3e72946
SSDEEP

24576:H1+7k4f2nPU3TzKVFkSwMdvWvZENg4kZmtPkhm/LoagKVMCwdSf4zLs7/fY7:Hk7V+nPruSwfiCAMhmjPyCwkfAIjg7

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3260-133-0x0000000010000000-0x00000000103CF000-memory.dmp	family_blackmoon

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

7 3260 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

3260 rundll32.exe

flow	pid	process
7	3260	rundll32.exe

pid	process
3260	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 628 wrote to memory of 3260	628	rundll32.exe	rundll32.exe
PID 628 wrote to memory of 3260	628	rundll32.exe	rundll32.exe
PID 628 wrote to memory of 3260	628	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9fa8ec7d36557b191e63f4b5a73d4ae0d7fb4b84e148a328be51f5031e4e03fc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:628

memory/3260-133-0x0000000010000000-0x00000000103CF000-memory.dmp

Filesize
3.8MB

Download
memory/3260-134-0x0000000000560000-0x0000000000563000-memory.dmp

Filesize
12KB

Download