blackmoon | 737ce22aa34496d7be3db0bbafb2dc03501155ed532c4a422d1ff2f006ec5cf2

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
16-11-2023 15:55

Target

737ce22aa34496d7be3db0bbafb2dc03501155ed532c4a422d1ff2f006ec5cf2.dll
Size

4.0MB
MD5

f3cdef8b8c0b1ed8606d20c2ebec222a
SHA1

f7373185035adc10d75d64e745cd624c140a5681
SHA256

737ce22aa34496d7be3db0bbafb2dc03501155ed532c4a422d1ff2f006ec5cf2
SHA512

6a0c2fa6368c583c6250b5c870baa332e14415943749479ae55d2ad4adf35df07c22d0e316b13cfad926e5f0659629c515eb2aa6fb9a289d5a8bcdf0dee6bf96
SSDEEP

49152:mE/uZakB6PGHKQmV2jqtH/fs1M/WEUpRO0YnMmPOfKGuG4gVzdysS095w4xYd4Ji:ZksMKQmV2js3fWzHnsRaDSioPk

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 3 IoCs

resource	yara_rule
behavioral1/memory/1732-2-0x0000000010000000-0x0000000010970000-memory.dmp	family_blackmoon
behavioral1/memory/1732-3-0x0000000010000000-0x0000000010970000-memory.dmp	family_blackmoon
behavioral1/memory/1732-9-0x0000000010000000-0x0000000010970000-memory.dmp	family_blackmoon

Loads dropped DLL 1 IoCs

pid	Process
1732	rundll32.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1732-0-0x0000000010000000-0x0000000010970000-memory.dmp	upx
behavioral1/memory/1732-1-0x0000000010000000-0x0000000010970000-memory.dmp	upx
behavioral1/memory/1732-2-0x0000000010000000-0x0000000010970000-memory.dmp	upx
behavioral1/memory/1732-3-0x0000000010000000-0x0000000010970000-memory.dmp	upx
behavioral1/memory/1732-8-0x0000000000110000-0x0000000000125000-memory.dmp	upx
behavioral1/memory/1732-9-0x0000000010000000-0x0000000010970000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1732	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1732	1464	rundll32.exe	28
PID 1464 wrote to memory of 1732	1464	rundll32.exe	28
PID 1464 wrote to memory of 1732	1464	rundll32.exe	28
PID 1464 wrote to memory of 1732	1464	rundll32.exe	28
PID 1464 wrote to memory of 1732	1464	rundll32.exe	28
PID 1464 wrote to memory of 1732	1464	rundll32.exe	28
PID 1464 wrote to memory of 1732	1464	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\737ce22aa34496d7be3db0bbafb2dc03501155ed532c4a422d1ff2f006ec5cf2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\737ce22aa34496d7be3db0bbafb2dc03501155ed532c4a422d1ff2f006ec5cf2.dll,#1
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1732

\Users\Admin\AppData\Local\Temp\E2EECore.2.7.2.dll

Filesize
8.4MB

MD5
8b6c94bbdbfb213e94a5dcb4fac28ce3

SHA1
b56102ca4f03556f387f8b30e2b404efabe0cb65

SHA256
982a177924762f270b36fe34c7d6847392b48ae53151dc2011078dceef487a53

SHA512
9d6d63b5d8cf7a978d7e91126d7a343c2f7acd00022da9d692f63e50835fdd84a59a93328564f10622f2b1f6adfd7febdd98b8ddb294d0754ed45cc9c165d25a

Download Submit
memory/1732-0-0x0000000010000000-0x0000000010970000-memory.dmp

Filesize
9.4MB

Download
memory/1732-1-0x0000000010000000-0x0000000010970000-memory.dmp

Filesize
9.4MB

Download
memory/1732-2-0x0000000010000000-0x0000000010970000-memory.dmp

Filesize
9.4MB

Download
memory/1732-3-0x0000000010000000-0x0000000010970000-memory.dmp

Filesize
9.4MB

Download
memory/1732-8-0x0000000000110000-0x0000000000125000-memory.dmp

Filesize
84KB

Download
memory/1732-9-0x0000000010000000-0x0000000010970000-memory.dmp

Filesize
9.4MB

Download