blackmoon | 6ee1b61191a46d775f83ef9805ed0403f06007cc853cd8ce3fcc734e9885a800

Analysis

max time kernel
128s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2023, 21:29

Target

6ee1b61191a46d775f83ef9805ed0403f06007cc853cd8ce3fcc734e9885a800.exe
Size

2.7MB
MD5

770305faddaa7c0322c849177624f0de
SHA1

4f86bbc73e79fe12c3c90ee6ace7e205de62ac09
SHA256

6ee1b61191a46d775f83ef9805ed0403f06007cc853cd8ce3fcc734e9885a800
SHA512

57f8cea0a47e6f09cbd3e68bd4568413953af2c84344aedc4d6926c95a3b0a6c4aab2d783861d983bd024fa1019dcc2893fc06c93e43f72c89c3cd3f06b0ab9f
SSDEEP

24576:cbrw/r4sEPEBnCi3wHqebIvs8Gtycdw7xE/htHlxv7TAMz7nLZmUW37ZkD41qj+6:cFPR5fRqdU9rkVZj3FF6

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral2/memory/4348-0-0x0000000000400000-0x00000000006CA000-memory.dmp	family_blackmoon

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2088	4348	WerFault.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4348	6ee1b61191a46d775f83ef9805ed0403f06007cc853cd8ce3fcc734e9885a800.exe

C:\Users\Admin\AppData\Local\Temp\6ee1b61191a46d775f83ef9805ed0403f06007cc853cd8ce3fcc734e9885a800.exe
"C:\Users\Admin\AppData\Local\Temp\6ee1b61191a46d775f83ef9805ed0403f06007cc853cd8ce3fcc734e9885a800.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 620
  2⤵
  - Program crash
  PID:2088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4348 -ip 4348
1⤵
PID:4832

memory/4348-0-0x0000000000400000-0x00000000006CA000-memory.dmp

Filesize
2.8MB

Download