blackmoon | 1539b3090eee98b44d3561eab056e246950c0c572175273a631997e9e2fefc54

Analysis

max time kernel
61s
max time network
82s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
21-06-2023 21:57

Target

1539b3090eee98b44d3561eab056e246950c0c572175273a631997e9e2fefc54.dll
Size

1.7MB
MD5

351543e77cea2639961d04cefc96c2b8
SHA1

eb0d6eee272ec0ddde230584a49d4ef06413720f
SHA256

1539b3090eee98b44d3561eab056e246950c0c572175273a631997e9e2fefc54
SHA512

9a8fc8268a558618be543af78adb255fec0923a8a00b0334608ae1104203215bfcd9191367994298927e861ac2e83a8d3c46e70c839e000c91e187a538a93086
SSDEEP

49152:H9ssEqqJ9Qm+drgu5XlrURszomJMSL0ZtEjcN0V:HOsvqTQTrgSXlrUu/J5L0Vy

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1496-133-0x0000000010000000-0x00000000104A5000-memory.dmp	family_blackmoon

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1496 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1496 rundll32.exe

flow	pid	process
2	1496	rundll32.exe

pid	process
1496	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4740 wrote to memory of 1496	4740	rundll32.exe	rundll32.exe
PID 4740 wrote to memory of 1496	4740	rundll32.exe	rundll32.exe
PID 4740 wrote to memory of 1496	4740	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1539b3090eee98b44d3561eab056e246950c0c572175273a631997e9e2fefc54.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4740

memory/1496-133-0x0000000010000000-0x00000000104A5000-memory.dmp

Filesize
4.6MB

Download
memory/1496-134-0x00000000001D0000-0x00000000001D3000-memory.dmp

Filesize
12KB

Download