blackmoon | e5f86cdb01ef3256b9fbf36bde7ed9ca31f098e3964d14824eb2517353015cd3

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 18:02

Target

e5f86cdb01ef3256b9fbf36bde7ed9ca31f098e3964d14824eb2517353015cd3.dll
Size

195KB
MD5

c24d81460e2df6cad4d1f691e7347492
SHA1

3d9d84f7770767f33b19c5371fa742c72ea64d71
SHA256

e5f86cdb01ef3256b9fbf36bde7ed9ca31f098e3964d14824eb2517353015cd3
SHA512

72ce9ddb983a7a6ca3e6fb550ec9afd158d50f5e164bc4c1236605576bae96462443b6433681c1c0d40356b25469ccd1eb7388535e007a24f4bdfe670d231a52
SSDEEP

6144:UoC1PFj0wQODX4vszHBqv22U1+0sk1A+oS:mxGq2lpGoS

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral2/memory/1788-11-0x0000000010000000-0x00000000100F8000-memory.dmp	family_blackmoon

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2576	1788	WerFault.exe	87

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	rundll32.exe
Token: SeDebugPrivilege	1788	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1788	1300	rundll32.exe	87
PID 1300 wrote to memory of 1788	1300	rundll32.exe	87
PID 1300 wrote to memory of 1788	1300	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5f86cdb01ef3256b9fbf36bde7ed9ca31f098e3964d14824eb2517353015cd3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5f86cdb01ef3256b9fbf36bde7ed9ca31f098e3964d14824eb2517353015cd3.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 864
    3⤵
    - Program crash
    PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1788 -ip 1788
1⤵
PID:4844

memory/1788-0-0x0000000010000000-0x00000000100F8000-memory.dmp

Filesize
992KB

Download
memory/1788-2-0x0000000001160000-0x000000000118B000-memory.dmp

Filesize
172KB

Download
memory/1788-1-0x0000000076F05000-0x0000000076F06000-memory.dmp

Filesize
4KB

Download
memory/1788-4-0x00000000769D0000-0x0000000076AC0000-memory.dmp

Filesize
960KB

Download
memory/1788-5-0x00000000769D0000-0x0000000076AC0000-memory.dmp

Filesize
960KB

Download
memory/1788-9-0x0000000076F1B000-0x0000000076F1C000-memory.dmp

Filesize
4KB

Download
memory/1788-8-0x0000000001160000-0x000000000118B000-memory.dmp

Filesize
172KB

Download
memory/1788-7-0x0000000076F03000-0x0000000076F04000-memory.dmp

Filesize
4KB

Download
memory/1788-6-0x0000000076F02000-0x0000000076F03000-memory.dmp

Filesize
4KB

Download
memory/1788-10-0x00000000006E0000-0x00000000006F4000-memory.dmp

Filesize
80KB

Download
memory/1788-11-0x0000000010000000-0x00000000100F8000-memory.dmp

Filesize
992KB

Download
memory/1788-12-0x00000000769D0000-0x0000000076AC0000-memory.dmp

Filesize
960KB

Download
memory/1788-13-0x0000000001160000-0x000000000118B000-memory.dmp

Filesize
172KB

Download