blackmoon | 13584df49a410ca84cba9ca169669d96c076d5a79499e352eccebbc24ac1f335

Analysis

max time kernel
118s
max time network
141s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 23:21

Target

13584df49a410ca84cba9ca169669d96c076d5a79499e352eccebbc24ac1f335.dll
Size

9.2MB
MD5

53451ddc38f39bfcb68f513cea02d5cc
SHA1

73c3a73b8bad6a4445ecf8a43041bf155c1fa0b2
SHA256

13584df49a410ca84cba9ca169669d96c076d5a79499e352eccebbc24ac1f335
SHA512

5afbc1e45979cd10f48d111956a60187b0389d5ce35ebf855b31116cef21515c8f08a3835af9e5124d2422686501d054a18d3ef174915ab85948cc4fdb7a2bb5
SSDEEP

196608:u3qVFB7PnpPvypQqOh/+7WWXtpI/rak3gaKKljMwDnTmN:u3mPnpPapROiI2k3hkk

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral1/memory/2160-0-0x0000000010000000-0x000000001093B000-memory.dmp	family_blackmoon

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2160-0-0x0000000010000000-0x000000001093B000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2160	2152	rundll32.exe	28
PID 2152 wrote to memory of 2160	2152	rundll32.exe	28
PID 2152 wrote to memory of 2160	2152	rundll32.exe	28
PID 2152 wrote to memory of 2160	2152	rundll32.exe	28
PID 2152 wrote to memory of 2160	2152	rundll32.exe	28
PID 2152 wrote to memory of 2160	2152	rundll32.exe	28
PID 2152 wrote to memory of 2160	2152	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13584df49a410ca84cba9ca169669d96c076d5a79499e352eccebbc24ac1f335.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\13584df49a410ca84cba9ca169669d96c076d5a79499e352eccebbc24ac1f335.dll,#1
  2⤵
  PID:2160

memory/2160-0-0x0000000010000000-0x000000001093B000-memory.dmp

Filesize
9.2MB

Download
memory/2160-1-0x0000000010000000-0x000000001093B000-memory.dmp

Filesize
9.2MB

Download
memory/2160-2-0x0000000010000000-0x000000001093B000-memory.dmp

Filesize
9.2MB

Download
memory/2160-3-0x0000000010000000-0x000000001093B000-memory.dmp

Filesize
9.2MB

Download