blackmoon | e02883ec247d19928c29f16322f265d27a7a4b75ef639e5d4a5a2c8e6aea5354

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
27-06-2023 19:43

Target

e02883ec247d19928c29f16322f265d27a7a4b75ef639e5d4a5a2c8e6aea5354.dll
Size

1.4MB
MD5

bd9c436782c27c67ef3e2766fc1fe35c
SHA1

52a39c5c4dfdb8d4c3338e018a83d6701f895671
SHA256

e02883ec247d19928c29f16322f265d27a7a4b75ef639e5d4a5a2c8e6aea5354
SHA512

bd844740d15b32a40e8f9eb4596524ff929e7054d833eb30ea75800fcafff3d96c15baf0ab83532e311ef331d95faea4f54eb21d5f7d3623a3d7cd7cd2c4b537
SSDEEP

24576:/CKPUvEeQXfTJoMSfFnazvJJijWFIj2PP9xFhLvTSMMDxMOA/0+WXWW198Wm4hrw:/n8vEfPKMSftsJOWFjHLvT3MDxB5h1Dj

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1372-54-0x0000000010000000-0x00000000103FC000-memory.dmp	family_blackmoon

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1372 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1372 rundll32.exe

flow	pid	process
2	1372	rundll32.exe

pid	process
1372	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1200 wrote to memory of 1372	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 1372	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 1372	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 1372	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 1372	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 1372	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 1372	1200	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e02883ec247d19928c29f16322f265d27a7a4b75ef639e5d4a5a2c8e6aea5354.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e02883ec247d19928c29f16322f265d27a7a4b75ef639e5d4a5a2c8e6aea5354.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of SetWindowsHookEx
  PID:1372

memory/1372-54-0x0000000010000000-0x00000000103FC000-memory.dmp

Filesize
4.0MB

Download
memory/1372-55-0x0000000000160000-0x0000000000163000-memory.dmp

Filesize
12KB

Download