blackmoon | 75ced63fc0e8ba01386e574446d53668ad71fb66fbf2c9c3a14b9e46de5c32fe

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 20:07

Target

75ced63fc0e8ba01386e574446d53668ad71fb66fbf2c9c3a14b9e46de5c32fe.exe
Size

4.6MB
MD5

915a246ee32212828dcbdf88067e21f0
SHA1

e75f1687c7f5583e7ff16e18533f622100b11911
SHA256

75ced63fc0e8ba01386e574446d53668ad71fb66fbf2c9c3a14b9e46de5c32fe
SHA512

e0fc6614d5ac67294336de3162afd5a19308f4b3c72ddfe04634eeef43dc1cba5ef2ce6757155e6d36492f6b41e2365f72a4ed4d92b4e3752214adae7fac5081
SSDEEP

49152:Fg3YGwfT2S/NB18s42t6t6mz53wJWqx2No61Ai2oB9Kgk6EaXtgjMdHCX0lBAlAv:vZfT2Yvnt6t6oEYN/SiLKwESgjMxS

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

resource	yara_rule
behavioral1/memory/2624-9-0x0000000000400000-0x00000000008D3000-memory.dmp	family_blackmoon
behavioral1/memory/2624-13-0x0000000000400000-0x00000000008D3000-memory.dmp	family_blackmoon

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2624-1-0x0000000010000000-0x0000000010019000-memory.dmp	upx
behavioral1/memory/2624-14-0x0000000010000000-0x0000000010019000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Dult.dll	75ced63fc0e8ba01386e574446d53668ad71fb66fbf2c9c3a14b9e46de5c32fe.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2688	2624	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2624	75ced63fc0e8ba01386e574446d53668ad71fb66fbf2c9c3a14b9e46de5c32fe.exe
Token: SeDebugPrivilege	2624	75ced63fc0e8ba01386e574446d53668ad71fb66fbf2c9c3a14b9e46de5c32fe.exe
Token: SeDebugPrivilege	2624	75ced63fc0e8ba01386e574446d53668ad71fb66fbf2c9c3a14b9e46de5c32fe.exe
Token: 1	2624	75ced63fc0e8ba01386e574446d53668ad71fb66fbf2c9c3a14b9e46de5c32fe.exe
Token: SeDebugPrivilege	2624	75ced63fc0e8ba01386e574446d53668ad71fb66fbf2c9c3a14b9e46de5c32fe.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2624	75ced63fc0e8ba01386e574446d53668ad71fb66fbf2c9c3a14b9e46de5c32fe.exe
2624	75ced63fc0e8ba01386e574446d53668ad71fb66fbf2c9c3a14b9e46de5c32fe.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2688	2624	75ced63fc0e8ba01386e574446d53668ad71fb66fbf2c9c3a14b9e46de5c32fe.exe	28
PID 2624 wrote to memory of 2688	2624	75ced63fc0e8ba01386e574446d53668ad71fb66fbf2c9c3a14b9e46de5c32fe.exe	28
PID 2624 wrote to memory of 2688	2624	75ced63fc0e8ba01386e574446d53668ad71fb66fbf2c9c3a14b9e46de5c32fe.exe	28
PID 2624 wrote to memory of 2688	2624	75ced63fc0e8ba01386e574446d53668ad71fb66fbf2c9c3a14b9e46de5c32fe.exe	28

C:\Users\Admin\AppData\Local\Temp\75ced63fc0e8ba01386e574446d53668ad71fb66fbf2c9c3a14b9e46de5c32fe.exe
"C:\Users\Admin\AppData\Local\Temp\75ced63fc0e8ba01386e574446d53668ad71fb66fbf2c9c3a14b9e46de5c32fe.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 344
  2⤵
  - Program crash
  PID:2688

memory/2624-1-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2624-9-0x0000000000400000-0x00000000008D3000-memory.dmp

Filesize
4.8MB

Download
memory/2624-13-0x0000000000400000-0x00000000008D3000-memory.dmp

Filesize
4.8MB

Download
memory/2624-14-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download