blackmoon | e651facbeff514badd53b86e62d389faa9d40ee799f27029c492a112e6a089db

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 17:46

Target
c67f1f3ab440f13a5c7ea184a16222d8.dll
Size 25KB
Sample240313-wch6vsdc46
SHA256 e651facbeff514badd53b86e62d389faa9d40ee799f27029c492a112e6a089db
MD5 c67f1f3ab440f13a5c7ea184a16222d8
SHA1 ee8f2c29a0b26dce078f9922f583debd5a8065ff
SHA512 535af516b104282d3528fe5cd25a23e8ae6820c05f9d64c3a56f7f6f0f9bc201b4a4a674538c13c7de5e364e76082a1575718dd0611c775bc8bd10233a771d0e
SSDEEP 768:FUXWviyYY2Ll1C4T/+cnv8WcGOxFbPrwI1:ZhYzTCg/v8WcFJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 4 IoCs

resource	yara_rule
behavioral1/memory/2192-1-0x0000000010000000-0x000000001001B000-memory.dmp	family_blackmoon
behavioral1/memory/2192-3-0x0000000010000000-0x000000001001B000-memory.dmp	family_blackmoon
behavioral1/memory/2192-4-0x0000000010000000-0x000000001001B000-memory.dmp	family_blackmoon
behavioral1/memory/2192-5-0x0000000010000000-0x000000001001B000-memory.dmp	family_blackmoon

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2192	2868	rundll32.exe	28
PID 2868 wrote to memory of 2192	2868	rundll32.exe	28
PID 2868 wrote to memory of 2192	2868	rundll32.exe	28
PID 2868 wrote to memory of 2192	2868	rundll32.exe	28
PID 2868 wrote to memory of 2192	2868	rundll32.exe	28
PID 2868 wrote to memory of 2192	2868	rundll32.exe	28
PID 2868 wrote to memory of 2192	2868	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c67f1f3ab440f13a5c7ea184a16222d8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c67f1f3ab440f13a5c7ea184a16222d8.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2192

memory/2192-1-0x0000000010000000-0x000000001001B000-memory.dmp

Download

memory/2192-3-0x0000000010000000-0x000000001001B000-memory.dmp

Download

memory/2192-4-0x0000000010000000-0x000000001001B000-memory.dmp

Download

memory/2192-5-0x0000000010000000-0x000000001001B000-memory.dmp

Download