blackmoon | c78cd60896096b8398725cf7a0cc96adc4507f2a557572db03eb3827b10a8c29

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
30/10/2023, 04:31

Target

c78cd60896096b8398725cf7a0cc96adc4507f2a557572db03eb3827b10a8c29.exe
Size

12.1MB
MD5

613b587392c22c13903a5fb29563fcb5
SHA1

fa7752eae8bb7dac918e7f1ab59f3cb316828e85
SHA256

c78cd60896096b8398725cf7a0cc96adc4507f2a557572db03eb3827b10a8c29
SHA512

6da08e6f18a0960f9d46cd4aeeb3b5ec37210e5b8ab397f6fd887c19410bd16e129f9355647ec3a7d29a31ede36af975bea41b0a1a35892c769277ed1457d628
SSDEEP

393216:Q0s3OXxKAE6K8S4ZtdDBwT8W6mYNWGSGW+bi:4OXxKv6Kn4TVBu6BhSGWai

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral1/memory/296-13-0x0000000000400000-0x0000000001048000-memory.dmp	family_blackmoon

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/296-10-0x0000000000240000-0x0000000000267000-memory.dmp	upx
behavioral1/memory/296-12-0x0000000000240000-0x0000000000267000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1972	296	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
296	c78cd60896096b8398725cf7a0cc96adc4507f2a557572db03eb3827b10a8c29.exe
296	c78cd60896096b8398725cf7a0cc96adc4507f2a557572db03eb3827b10a8c29.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 296 wrote to memory of 1972	296	c78cd60896096b8398725cf7a0cc96adc4507f2a557572db03eb3827b10a8c29.exe	28
PID 296 wrote to memory of 1972	296	c78cd60896096b8398725cf7a0cc96adc4507f2a557572db03eb3827b10a8c29.exe	28
PID 296 wrote to memory of 1972	296	c78cd60896096b8398725cf7a0cc96adc4507f2a557572db03eb3827b10a8c29.exe	28
PID 296 wrote to memory of 1972	296	c78cd60896096b8398725cf7a0cc96adc4507f2a557572db03eb3827b10a8c29.exe	28

C:\Users\Admin\AppData\Local\Temp\c78cd60896096b8398725cf7a0cc96adc4507f2a557572db03eb3827b10a8c29.exe
"C:\Users\Admin\AppData\Local\Temp\c78cd60896096b8398725cf7a0cc96adc4507f2a557572db03eb3827b10a8c29.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 296 -s 320
  2⤵
  - Program crash
  PID:1972

memory/296-0-0x0000000000400000-0x0000000001048000-memory.dmp

Filesize
12.3MB

Download
memory/296-1-0x0000000003920000-0x0000000004184000-memory.dmp

Filesize
8.4MB

Download
memory/296-5-0x0000000003920000-0x0000000004184000-memory.dmp

Filesize
8.4MB

Download
memory/296-10-0x0000000000240000-0x0000000000267000-memory.dmp

Filesize
156KB

Download
memory/296-11-0x0000000003920000-0x0000000004184000-memory.dmp

Filesize
8.4MB

Download
memory/296-12-0x0000000000240000-0x0000000000267000-memory.dmp

Filesize
156KB

Download
memory/296-13-0x0000000000400000-0x0000000001048000-memory.dmp

Filesize
12.3MB

Download