blackmoon | 79c9ac76cade83e42ce6e8f269e7b47292a3f6a9316fc867d9af0376e1a7dacc

Analysis

max time kernel
72s
max time network
76s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
04-07-2023 20:10

Target

79c9ac76cade83e42ce6e8f26.exe
Size

672KB
MD5

a1ab759393bae62b53fce57cfd2cf6cb
SHA1

45b1f4b26275779ef4fdeb7b6edf76c13ce786d1
SHA256

79c9ac76cade83e42ce6e8f269e7b47292a3f6a9316fc867d9af0376e1a7dacc
SHA512

3b30bb992019ea2d0e0bd0a9724e3033552670965c004bbe3535551a17d3e3b60aa12693a09f3239fe3ddf2e01e85649a8baf4b0eea0507964d17b45e7c94810
SSDEEP

12288:/VicRzImSt0mA0DgkDPWluMAG2BahHuvrziZvov7Y5lrIp0BgTkYEMGKT9b0oS4:/VicRXSt0mfD1DOLLQaOfihruAxkF

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1368-54-0x0000000000400000-0x0000000000597000-memory.dmp	family_blackmoon
behavioral1/memory/1368-55-0x0000000000400000-0x0000000000597000-memory.dmp	family_blackmoon

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1368-54-0x0000000000400000-0x0000000000597000-memory.dmp	upx
behavioral1/memory/1368-55-0x0000000000400000-0x0000000000597000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

79c9ac76cade83e42ce6e8f26.exe

pid process

1368 79c9ac76cade83e42ce6e8f26.exe

pid	process
1368	79c9ac76cade83e42ce6e8f26.exe

C:\Users\Admin\AppData\Local\Temp\79c9ac76cade83e42ce6e8f26.exe
"C:\Users\Admin\AppData\Local\Temp\79c9ac76cade83e42ce6e8f26.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1368

memory/1368-54-0x0000000000400000-0x0000000000597000-memory.dmp

Filesize
1.6MB

Download
memory/1368-55-0x0000000000400000-0x0000000000597000-memory.dmp

Filesize
1.6MB

Download