blackmoon | 608c0b0a7e59c3e9cdb2866f9f62fe604e804871c2941cb4a424e5ecbf89d818

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2023 18:26

Target

608c0b0a7e59c3e9cdb2866f9f62fe604e804871c2941cb4a424e5ecbf89d818.dll
Size

265KB
MD5

52c59b73b246b999a63ce6b414c92257
SHA1

79837a5aafaaf7b5f2d2e1db66c3b76233b4bc8b
SHA256

608c0b0a7e59c3e9cdb2866f9f62fe604e804871c2941cb4a424e5ecbf89d818
SHA512

321d9d9617de63ea1af78d66bc5a914bad2b48e62e7285761d27b5884e81d3dbcec780ba8305f8418109f9e90ed752a16f02b254d8295ef22b6b6c27c540bc1a
SSDEEP

3072:01bP42BwhcFfzguuUjZT4/hF0PxqTbuRTVcmtqNz:01M2BwhefzgzWo8Pkdl

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4692-133-0x0000000075790000-0x000000007580D000-memory.dmp	family_blackmoon

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3540 wrote to memory of 4692	3540	rundll32.exe	rundll32.exe
PID 3540 wrote to memory of 4692	3540	rundll32.exe	rundll32.exe
PID 3540 wrote to memory of 4692	3540	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\608c0b0a7e59c3e9cdb2866f9f62fe604e804871c2941cb4a424e5ecbf89d818.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\608c0b0a7e59c3e9cdb2866f9f62fe604e804871c2941cb4a424e5ecbf89d818.dll,#1
  2⤵
  PID:4692

memory/4692-133-0x0000000075790000-0x000000007580D000-memory.dmp

Filesize
500KB

Download