blackmoon | 13584df49a410ca84cba9ca169669d96c076d5a79499e352eccebbc24ac1f335

Analysis

max time kernel
151s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 23:21

Target

13584df49a410ca84cba9ca169669d96c076d5a79499e352eccebbc24ac1f335.dll
Size

9.2MB
MD5

53451ddc38f39bfcb68f513cea02d5cc
SHA1

73c3a73b8bad6a4445ecf8a43041bf155c1fa0b2
SHA256

13584df49a410ca84cba9ca169669d96c076d5a79499e352eccebbc24ac1f335
SHA512

5afbc1e45979cd10f48d111956a60187b0389d5ce35ebf855b31116cef21515c8f08a3835af9e5124d2422686501d054a18d3ef174915ab85948cc4fdb7a2bb5
SSDEEP

196608:u3qVFB7PnpPvypQqOh/+7WWXtpI/rak3gaKKljMwDnTmN:u3mPnpPapROiI2k3hkk

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral2/memory/2032-0-0x0000000010000000-0x000000001093B000-memory.dmp	family_blackmoon

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/2032-0-0x0000000010000000-0x000000001093B000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2716	2032	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 2032	3280	rundll32.exe	87
PID 3280 wrote to memory of 2032	3280	rundll32.exe	87
PID 3280 wrote to memory of 2032	3280	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13584df49a410ca84cba9ca169669d96c076d5a79499e352eccebbc24ac1f335.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\13584df49a410ca84cba9ca169669d96c076d5a79499e352eccebbc24ac1f335.dll,#1
  2⤵
  PID:2032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 564
    3⤵
    - Program crash
    PID:2716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2032 -ip 2032
1⤵
PID:2464

memory/2032-0-0x0000000010000000-0x000000001093B000-memory.dmp

Filesize
9.2MB

Download