blackmoon | 5297ea7b43a12c7e21f7445efbcda59b4e64c4e66422eac052fda48382d8eddb

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 21:09

Target

5297ea7b43a12c7e21f7445efbcda59b4e64c4e66422eac052fda48382d8eddb.dll
Size

74KB
MD5

0000dde7c0014dfde9b1bd54d9ef14fe
SHA1

4c7ea9b565c23be3f24b0ebf99316c2f1900ff23
SHA256

5297ea7b43a12c7e21f7445efbcda59b4e64c4e66422eac052fda48382d8eddb
SHA512

80941a279ed29214c6a0d2ab0d594d874979a5d40a39180be5d5f416f649c4fa2b687a62c9ac98e9f534c4eac9b94022fe8fd0056c6ae8c8d2b428537683fe68
SSDEEP

1536:HClQbIyxSswdoLEmh97VqcQbsJ1yz8zcRH9EG94nV3g45CJQ6AWzLdhBYnouy8Y:iab3PxImhQcW8zchpeV3gMCJQ6AWzLyO

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral2/memory/316-1-0x0000000010000000-0x0000000010056000-memory.dmp	family_blackmoon

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/316-0-0x0000000010000000-0x0000000010056000-memory.dmp	upx
behavioral2/memory/316-1-0x0000000010000000-0x0000000010056000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3732	316	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 316	3300	rundll32.exe	90
PID 3300 wrote to memory of 316	3300	rundll32.exe	90
PID 3300 wrote to memory of 316	3300	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5297ea7b43a12c7e21f7445efbcda59b4e64c4e66422eac052fda48382d8eddb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5297ea7b43a12c7e21f7445efbcda59b4e64c4e66422eac052fda48382d8eddb.dll,#1
  2⤵
  PID:316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 692
    3⤵
    - Program crash
    PID:3732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 316 -ip 316
1⤵
PID:3660

memory/316-0-0x0000000010000000-0x0000000010056000-memory.dmp

Filesize
344KB

Download
memory/316-1-0x0000000010000000-0x0000000010056000-memory.dmp

Filesize
344KB

Download