blackmoon | 24cec2bd1249842ed7d8e45566b2e9eae9fc7aca3ee976823564f45691148fb5

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 20:00

Target
24cec2bd1249842ed7d8e45566b2e9eae9fc7aca3ee976823564f45691148fb5.exe
Size 136KB
Sample240409-yq4e3acc2v
SHA256 24cec2bd1249842ed7d8e45566b2e9eae9fc7aca3ee976823564f45691148fb5
MD5 14ac78f59fd00e54b985c17565c9d91f
SHA1 f8707c0d5edeb8276495ae61b619fb47320b7176
SHA512 9400c1f0afced7d97c95003b3ce7596943599c92a92189864ea4aac8af71402aa568c3d2bda6940456022fb6a6bd5a62ce014860b1431df0ddd7877be7c2ea23
SSDEEP 1536:Md+zUtBIBU+2Da4lH4Iiue58o/ZDv4GMfcHZIlVKAn5ZAcXeOqbZ6NjkY:OqSe5OmiEoAcCbZ6r
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000a0000000231a5-3.dat	family_blackmoon

Deletes itself 1 IoCs

pid	Process
4312	flrfxxl.exe

Executes dropped EXE 1 IoCs

pid	Process
4312	flrfxxl.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	\??\c:\windows\friendl.dll	flrfxxl.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 4312	1864	24cec2bd1249842ed7d8e45566b2e9eae9fc7aca3ee976823564f45691148fb5.exe	86
PID 1864 wrote to memory of 4312	1864	24cec2bd1249842ed7d8e45566b2e9eae9fc7aca3ee976823564f45691148fb5.exe	86
PID 1864 wrote to memory of 4312	1864	24cec2bd1249842ed7d8e45566b2e9eae9fc7aca3ee976823564f45691148fb5.exe	86

C:\Users\Admin\AppData\Local\Temp\24cec2bd1249842ed7d8e45566b2e9eae9fc7aca3ee976823564f45691148fb5.exe
"C:\Users\Admin\AppData\Local\Temp\24cec2bd1249842ed7d8e45566b2e9eae9fc7aca3ee976823564f45691148fb5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- \??\c:\flrfxxl.exe
  c:\flrfxxl.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:4312

flrfxxl.exe

Path C:\flrfxxl.exe
Size 136KB
SHA256 3a8b5bdaee47268d6875d33e537ce8dddb14add5aa5b08222ff0f8dbf17a2c13
MD5 cebe7edbe093992e1f95f7fd6e14f658
SHA1 4a5ff2e6e7fe4eceec0e7b0a0f24deed76469751
SHA512 53c683b2faad965845c8ef858e33a97605ebecd793802e36f63583213034c107edf58410417505090cee4fb2c940b5e85849c647c50d7e506cb9cc2d2ef86925
SSDEEP 1536:Md+zUtBIBU+2Da4lH4Iiue58o/ZDv4GMfcHZIlVKAn5ZAcXeOqbZ6Njk+:OqSe5OmiEoAcCbZ6L
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path \??\c:\jl
Size 102B
SHA256 b30dfb27069f30f578025b9db186d711138c3db20e63c5e2567804c0c97826f8
MD5 eca43c0aa539ba44210ff0bdd9799a14
SHA1 c55405275f766cf6a230b2aab9152b29be6840ff
SHA512 2a1765083fb1b363589ae639655bad13fdfb483af15d27eef3ebb2c3b32bcad874e9b98fb6b94f0932fdd09ade1430a7b3bfe3975fcee7fe743dcdbe969faedc
MD5 SHA1 SHA512

Submit Download