blackmoon | 57d2555438d69ce2f31f38bf09ac7fc3b536d272aa3eb50701d9e14a5f8bb425

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
30-06-2023 11:54

Target

57d2555438d69ce2f31f38bf0.dll
Size

1.4MB
MD5

b0eeb9ddc03bb0f2ef677fc1c756cc4e
SHA1

40d5349e77c4e01a0c1d2628616301ce21f8e479
SHA256

57d2555438d69ce2f31f38bf09ac7fc3b536d272aa3eb50701d9e14a5f8bb425
SHA512

ca9f9bad72b45d56f80fb5b199414246ffcd20afa2a4ef55a94bd3ada547077e995e4b6e6568d814a94b4661053afc892847e7d71eec3e18b582f5d0c921cb87
SSDEEP

24576:N58E90z5gLu8fV75D2rD8k8wdlVQal04rztQkpa5WSLTt9mCAzpjUT6k7MVOVTaH:dygLuMVYrDFLl0z7gSL2xQ6kEIehZv

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2004-54-0x0000000010000000-0x00000000103C2000-memory.dmp	family_blackmoon

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 2004 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

2004 rundll32.exe

flow	pid	process
2	2004	rundll32.exe

pid	process
2004	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1080 wrote to memory of 2004	1080	rundll32.exe	rundll32.exe
PID 1080 wrote to memory of 2004	1080	rundll32.exe	rundll32.exe
PID 1080 wrote to memory of 2004	1080	rundll32.exe	rundll32.exe
PID 1080 wrote to memory of 2004	1080	rundll32.exe	rundll32.exe
PID 1080 wrote to memory of 2004	1080	rundll32.exe	rundll32.exe
PID 1080 wrote to memory of 2004	1080	rundll32.exe	rundll32.exe
PID 1080 wrote to memory of 2004	1080	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\57d2555438d69ce2f31f38bf0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1080

memory/2004-54-0x0000000010000000-0x00000000103C2000-memory.dmp

Filesize
3.8MB

Download
memory/2004-55-0x00000000000C0000-0x00000000000C3000-memory.dmp

Filesize
12KB

Download