blackmoon | 9e08a3ac1c59d6f45d4caa6b51a0613bf2f37dacc10feaeee89c1181070621db

Analysis

max time kernel
90s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2023, 03:31

Target

9e08a3ac1c59d6f45d4caa6b51a0613bf2f37dacc10feaeee89c1181070621db.exe
Size

3.0MB
MD5

ef9e66b79f63a05fca0b35ab9b9c9b39
SHA1

de26f72f36bcdfbe0ff34aed4e2e0b099db818ea
SHA256

9e08a3ac1c59d6f45d4caa6b51a0613bf2f37dacc10feaeee89c1181070621db
SHA512

8a469caeb5e84d4d32acedf5a79e96cde1dd1369f559f52e83f6fbf1745508f837d0317318b39af2c43e0e6e5e28c422a7934adb4d8487d80f8bed71d2d30e23
SSDEEP

49152:PEKxs9A/KtubnUXw00jiTEsqVu3Bnme3apSKJtgInIPGDq6hJ5XG01D8NJMSpxF:MKxse/Ktub2w00Ntne4lJWInKDNLtL

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

resource	yara_rule
behavioral2/memory/3672-0-0x0000000000400000-0x0000000000705000-memory.dmp	family_blackmoon
behavioral2/memory/3672-1-0x0000000000400000-0x0000000000705000-memory.dmp	family_blackmoon

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3672	9e08a3ac1c59d6f45d4caa6b51a0613bf2f37dacc10feaeee89c1181070621db.exe
3672	9e08a3ac1c59d6f45d4caa6b51a0613bf2f37dacc10feaeee89c1181070621db.exe

C:\Users\Admin\AppData\Local\Temp\9e08a3ac1c59d6f45d4caa6b51a0613bf2f37dacc10feaeee89c1181070621db.exe
"C:\Users\Admin\AppData\Local\Temp\9e08a3ac1c59d6f45d4caa6b51a0613bf2f37dacc10feaeee89c1181070621db.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3672

memory/3672-0-0x0000000000400000-0x0000000000705000-memory.dmp

Filesize
3.0MB

Download
memory/3672-1-0x0000000000400000-0x0000000000705000-memory.dmp

Filesize
3.0MB

Download