blackmoon | 3c382259267fbc1c7bb29dbf7e3722c04058abe78b9f63f622a1c00a47a47895

Analysis

max time kernel
197s
max time network
271s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
06-07-2023 14:15

Target

dda997a1a3a0bfb4d5702a88cfb7dfc1bce101a69d311793fe4c7f746845be8f.exe
Size

39KB
MD5

fc67cfa99cfe6a556a8ad8a730ecdda6
SHA1

2b97fc2c967622fc7415d8c294a1e2e3180d10f2
SHA256

dda997a1a3a0bfb4d5702a88cfb7dfc1bce101a69d311793fe4c7f746845be8f
SHA512

f62fb2f52c6347246e1d5b3b03eb3c74ae3ddf91d6e80d4d5d26d0cf249488f65bf1359cac54e2b65a89894e0400e393f8bc44f21b89971128122a1ce34a2dec
SSDEEP

768:rQuD/5QQf7RVMJ25hQ45/mjGxjQ+OX0JpXLbbL7:dD/pfFVM4fQ45Oj4j5OX0nXTL7

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2284-133-0x0000000000400000-0x000000000041B200-memory.dmp	family_blackmoon
behavioral1/memory/2284-135-0x0000000000400000-0x000000000041B200-memory.dmp	family_blackmoon

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4200 2284 WerFault.exe dda997a1a3a0bfb4d5702a88cfb7dfc1bce101a69d311793fe4c7f746845be8f.exe

pid	pid_target	process	target process
4200	2284	WerFault.exe	dda997a1a3a0bfb4d5702a88cfb7dfc1bce101a69d311793fe4c7f746845be8f.exe

C:\Users\Admin\AppData\Local\Temp\dda997a1a3a0bfb4d5702a88cfb7dfc1bce101a69d311793fe4c7f746845be8f.exe
"C:\Users\Admin\AppData\Local\Temp\dda997a1a3a0bfb4d5702a88cfb7dfc1bce101a69d311793fe4c7f746845be8f.exe"
1⤵
PID:2284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 288
  2⤵
  - Program crash
  PID:4200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2284 -ip 2284
1⤵
PID:2236

memory/2284-133-0x0000000000400000-0x000000000041B200-memory.dmp

Filesize
108KB

Download
memory/2284-134-0x0000000000030000-0x000000000003E000-memory.dmp

Filesize
56KB

Download
memory/2284-135-0x0000000000400000-0x000000000041B200-memory.dmp

Filesize
108KB

Download