blackmoon | 6ee1b61191a46d775f83ef9805ed0403f06007cc853cd8ce3fcc734e9885a800

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23-08-2023 21:29

Target

6ee1b61191a46d775f83ef9805ed0403f06007cc853cd8ce3fcc734e9885a800.exe
Size

2.7MB
MD5

770305faddaa7c0322c849177624f0de
SHA1

4f86bbc73e79fe12c3c90ee6ace7e205de62ac09
SHA256

6ee1b61191a46d775f83ef9805ed0403f06007cc853cd8ce3fcc734e9885a800
SHA512

57f8cea0a47e6f09cbd3e68bd4568413953af2c84344aedc4d6926c95a3b0a6c4aab2d783861d983bd024fa1019dcc2893fc06c93e43f72c89c3cd3f06b0ab9f
SSDEEP

24576:cbrw/r4sEPEBnCi3wHqebIvs8Gtycdw7xE/htHlxv7TAMz7nLZmUW37ZkD41qj+6:cFPR5fRqdU9rkVZj3FF6

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral1/memory/1496-0-0x0000000000400000-0x00000000006CA000-memory.dmp	family_blackmoon

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2884	1496	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1496	6ee1b61191a46d775f83ef9805ed0403f06007cc853cd8ce3fcc734e9885a800.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 2884	1496	6ee1b61191a46d775f83ef9805ed0403f06007cc853cd8ce3fcc734e9885a800.exe	28
PID 1496 wrote to memory of 2884	1496	6ee1b61191a46d775f83ef9805ed0403f06007cc853cd8ce3fcc734e9885a800.exe	28
PID 1496 wrote to memory of 2884	1496	6ee1b61191a46d775f83ef9805ed0403f06007cc853cd8ce3fcc734e9885a800.exe	28
PID 1496 wrote to memory of 2884	1496	6ee1b61191a46d775f83ef9805ed0403f06007cc853cd8ce3fcc734e9885a800.exe	28

C:\Users\Admin\AppData\Local\Temp\6ee1b61191a46d775f83ef9805ed0403f06007cc853cd8ce3fcc734e9885a800.exe
"C:\Users\Admin\AppData\Local\Temp\6ee1b61191a46d775f83ef9805ed0403f06007cc853cd8ce3fcc734e9885a800.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 272
  2⤵
  - Program crash
  PID:2884

memory/1496-0-0x0000000000400000-0x00000000006CA000-memory.dmp

Filesize
2.8MB

Download