blackmoon | 5297ea7b43a12c7e21f7445efbcda59b4e64c4e66422eac052fda48382d8eddb

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 21:09

Target

5297ea7b43a12c7e21f7445efbcda59b4e64c4e66422eac052fda48382d8eddb.dll
Size

74KB
MD5

0000dde7c0014dfde9b1bd54d9ef14fe
SHA1

4c7ea9b565c23be3f24b0ebf99316c2f1900ff23
SHA256

5297ea7b43a12c7e21f7445efbcda59b4e64c4e66422eac052fda48382d8eddb
SHA512

80941a279ed29214c6a0d2ab0d594d874979a5d40a39180be5d5f416f649c4fa2b687a62c9ac98e9f534c4eac9b94022fe8fd0056c6ae8c8d2b428537683fe68
SSDEEP

1536:HClQbIyxSswdoLEmh97VqcQbsJ1yz8zcRH9EG94nV3g45CJQ6AWzLdhBYnouy8Y:iab3PxImhQcW8zchpeV3gMCJQ6AWzLyO

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

resource	yara_rule
behavioral1/memory/2660-0-0x0000000010000000-0x0000000010056000-memory.dmp	family_blackmoon
behavioral1/memory/2660-1-0x0000000010000000-0x0000000010056000-memory.dmp	family_blackmoon

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2660-0-0x0000000010000000-0x0000000010056000-memory.dmp	upx
behavioral1/memory/2660-1-0x0000000010000000-0x0000000010056000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5297ea7b43a12c7e21f7445efbcda59b4e64c4e66422eac052fda48382d8eddb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5297ea7b43a12c7e21f7445efbcda59b4e64c4e66422eac052fda48382d8eddb.dll,#1
  2⤵
  PID:2660

memory/2660-0-0x0000000010000000-0x0000000010056000-memory.dmp

Filesize
344KB

Download
memory/2660-1-0x0000000010000000-0x0000000010056000-memory.dmp

Filesize
344KB

Download