blackmoon | ad4417cca1746b68ee649d8ea9f36ad806cfb2568ac6427de5de65bb7f7d7038

Analysis

max time kernel
155s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:22

Target

ad4417cca1746b68ee649d8ea9f36ad806cfb2568ac6427de5de65bb7f7d7038.exe
Size

4.5MB
MD5

7f1ba2cc62747833abbc33b9dfa774d6
SHA1

ee8d5f79106663e29352f7e0bf217d085085cc27
SHA256

ad4417cca1746b68ee649d8ea9f36ad806cfb2568ac6427de5de65bb7f7d7038
SHA512

52a510d3514c4c7ec07c6310f4cf8de99ec9ac20038858c87f86a72e19f5262f55da0ae5f3ba06755946076eb725124d4ca22b8e9fe67ab1eaef12e8db47176c
SSDEEP

49152:xNIlEFEedDqnroHO8wOZHOlSbuambSIN+6a9AknH:xNIicnsHtvZHfbmb/+TK

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral1/memory/2076-0-0x0000000000400000-0x0000000000891000-memory.dmp	family_blackmoon

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2508	2076	WerFault.exe	3

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2508	2076	ad4417cca1746b68ee649d8ea9f36ad806cfb2568ac6427de5de65bb7f7d7038.exe	27
PID 2076 wrote to memory of 2508	2076	ad4417cca1746b68ee649d8ea9f36ad806cfb2568ac6427de5de65bb7f7d7038.exe	27
PID 2076 wrote to memory of 2508	2076	ad4417cca1746b68ee649d8ea9f36ad806cfb2568ac6427de5de65bb7f7d7038.exe	27
PID 2076 wrote to memory of 2508	2076	ad4417cca1746b68ee649d8ea9f36ad806cfb2568ac6427de5de65bb7f7d7038.exe	27

C:\Users\Admin\AppData\Local\Temp\ad4417cca1746b68ee649d8ea9f36ad806cfb2568ac6427de5de65bb7f7d7038.exe
"C:\Users\Admin\AppData\Local\Temp\ad4417cca1746b68ee649d8ea9f36ad806cfb2568ac6427de5de65bb7f7d7038.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 156
  2⤵
  - Program crash
  PID:2508

memory/2076-0-0x0000000000400000-0x0000000000891000-memory.dmp

Filesize
4.6MB

Download