blackmoon | e86679a67ed0d317482c971fc027d3b2dbfce6f63a466fc9fb743fccdebad338

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19-07-2023 13:27

Target

e84d0da2ea2ff2exe_JC.exe
Size

4.6MB
MD5

e84d0da2ea2ff2874c919e74ec32b8e2
SHA1

7771c99bd2281f1bc09c6e697beaf01e9766466f
SHA256

e86679a67ed0d317482c971fc027d3b2dbfce6f63a466fc9fb743fccdebad338
SHA512

9df0dc8129e82f564fb6366d362c9a83dcf61eee4f2b3a08b8e9b6374bafc2580747724646311d3380d838b6876c21853460bb08ea597738e1d5574cf2d1c800
SSDEEP

49152:LxDcNG+IkQmMASeMVY7nodtegbcrfxF/CvXqz53wJWqj2N3AJJ//A:tDcNrIk9MA5GMnitegbc3/CkEGN

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2468-59-0x0000000000400000-0x00000000008F3000-memory.dmp	family_blackmoon
behavioral1/memory/2468-66-0x0000000000400000-0x00000000008F3000-memory.dmp	family_blackmoon
behavioral1/memory/2468-67-0x0000000000400000-0x00000000008F3000-memory.dmp	family_blackmoon
behavioral1/memory/2468-69-0x0000000000400000-0x00000000008F3000-memory.dmp	family_blackmoon

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/2468-54-0x0000000010000000-0x0000000010019000-memory.dmp	upx
behavioral1/memory/2468-68-0x0000000010000000-0x0000000010019000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

Processes:

e84d0da2ea2ff2exe_JC.exe

description ioc process

File created C:\Windows\SysWOW64\Dult.dll e84d0da2ea2ff2exe_JC.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2196 2468 WerFault.exe e84d0da2ea2ff2exe_JC.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Dult.dll	e84d0da2ea2ff2exe_JC.exe

pid	pid_target	process	target process
2196	2468	WerFault.exe	e84d0da2ea2ff2exe_JC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

e84d0da2ea2ff2exe_JC.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

e84d0da2ea2ff2exe_JC.exe

pid process

2468 e84d0da2ea2ff2exe_JC.exe
2468 e84d0da2ea2ff2exe_JC.exe

pid	process
2468	e84d0da2ea2ff2exe_JC.exe
2468	e84d0da2ea2ff2exe_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e84d0da2ea2ff2exe_JC.exe

description	pid	process	target process
PID 2468 wrote to memory of 2196	2468	e84d0da2ea2ff2exe_JC.exe	WerFault.exe
PID 2468 wrote to memory of 2196	2468	e84d0da2ea2ff2exe_JC.exe	WerFault.exe
PID 2468 wrote to memory of 2196	2468	e84d0da2ea2ff2exe_JC.exe	WerFault.exe
PID 2468 wrote to memory of 2196	2468	e84d0da2ea2ff2exe_JC.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e84d0da2ea2ff2exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\e84d0da2ea2ff2exe_JC.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 448
  2⤵
  - Program crash
  PID:2196

memory/2468-54-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2468-59-0x0000000000400000-0x00000000008F3000-memory.dmp

Filesize
4.9MB

Download
memory/2468-66-0x0000000000400000-0x00000000008F3000-memory.dmp

Filesize
4.9MB

Download
memory/2468-67-0x0000000000400000-0x00000000008F3000-memory.dmp

Filesize
4.9MB

Download
memory/2468-68-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2468-69-0x0000000000400000-0x00000000008F3000-memory.dmp

Filesize
4.9MB

Download