blackmoon | 24cec2bd1249842ed7d8e45566b2e9eae9fc7aca3ee976823564f45691148fb5

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 20:00

Target
24cec2bd1249842ed7d8e45566b2e9eae9fc7aca3ee976823564f45691148fb5.exe
Size 136KB
Sample240409-yq4e3acc2v
SHA256 24cec2bd1249842ed7d8e45566b2e9eae9fc7aca3ee976823564f45691148fb5
MD5 14ac78f59fd00e54b985c17565c9d91f
SHA1 f8707c0d5edeb8276495ae61b619fb47320b7176
SHA512 9400c1f0afced7d97c95003b3ce7596943599c92a92189864ea4aac8af71402aa568c3d2bda6940456022fb6a6bd5a62ce014860b1431df0ddd7877be7c2ea23
SSDEEP 1536:Md+zUtBIBU+2Da4lH4Iiue58o/ZDv4GMfcHZIlVKAn5ZAcXeOqbZ6NjkY:OqSe5OmiEoAcCbZ6r
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000e0000000122a4-5.dat	family_blackmoon

Deletes itself 1 IoCs

pid	Process
2884	khhjhp.exe

Executes dropped EXE 1 IoCs

pid	Process
2884	khhjhp.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	\??\c:\windows\friendl.dll	khhjhp.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2884	2200	24cec2bd1249842ed7d8e45566b2e9eae9fc7aca3ee976823564f45691148fb5.exe	28
PID 2200 wrote to memory of 2884	2200	24cec2bd1249842ed7d8e45566b2e9eae9fc7aca3ee976823564f45691148fb5.exe	28
PID 2200 wrote to memory of 2884	2200	24cec2bd1249842ed7d8e45566b2e9eae9fc7aca3ee976823564f45691148fb5.exe	28
PID 2200 wrote to memory of 2884	2200	24cec2bd1249842ed7d8e45566b2e9eae9fc7aca3ee976823564f45691148fb5.exe	28

C:\Users\Admin\AppData\Local\Temp\24cec2bd1249842ed7d8e45566b2e9eae9fc7aca3ee976823564f45691148fb5.exe
"C:\Users\Admin\AppData\Local\Temp\24cec2bd1249842ed7d8e45566b2e9eae9fc7aca3ee976823564f45691148fb5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- \??\c:\khhjhp.exe
  c:\khhjhp.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:2884

khhjhp.exe

Path C:\khhjhp.exe
Size 136KB
SHA256 dffb3a9c77846ee18ceb24e8a2f13d86550186dff09b9a64ec0b4a81fd33fe69
MD5 b32c049a3ad0cf771fad279aa7701c10
SHA1 731e48a49c35bfc3fcb7d9f387b93d024a9f51fb
SHA512 bb8fc5c66a119b5a8422bf15eae6a9060b382194614815d64d9b7d7ba5546e309f1d9d0f3f65d09eed25726ee07ff46520e217b950692adc214eb8c70ce3a67f
SSDEEP 1536:Md+zUtBIBU+2Da4lH4Iiue58o/ZDv4GMfcHZIlVKAn5ZAcXeOqbZ6Njku:OqSe5OmiEoAcCbZ65
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path \??\c:\jl
Size 102B
SHA256 b30dfb27069f30f578025b9db186d711138c3db20e63c5e2567804c0c97826f8
MD5 eca43c0aa539ba44210ff0bdd9799a14
SHA1 c55405275f766cf6a230b2aab9152b29be6840ff
SHA512 2a1765083fb1b363589ae639655bad13fdfb483af15d27eef3ebb2c3b32bcad874e9b98fb6b94f0932fdd09ade1430a7b3bfe3975fcee7fe743dcdbe969faedc
MD5 SHA1 SHA512

Submit Download