blackmoon | c1376706f74874c77d93d38af6bfc6addaea16106466be1493c0f1ef9837dcc5

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 10:08

Target

c1376706f74874c77d93d38af6bfc6addaea16106466be1493c0f1ef9837dcc5.exe
Size

2.0MB
MD5

d6151a61a3c00e5900ed6bdc5c88cd7b
SHA1

b9dcc94e70156489c6a85d1836b2c91390107885
SHA256

c1376706f74874c77d93d38af6bfc6addaea16106466be1493c0f1ef9837dcc5
SHA512

e889fdc3bcf73e4bb823c44379433f56ccfb828638377de49eb201a488b05def6467f1d842495314a933ec01893a8bb57acbcf38c6d660175d3ad7335e63a817
SSDEEP

49152:3LzrbFxc/JtgodtixvZ92bGJSh/zrygB9onyX1DQl:bLYPDPixz2KcdnpB9oeQl

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 4 IoCs

resource	yara_rule
behavioral2/memory/2868-1-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/2868-2-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/2868-3-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/2868-9-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3544	2868	WerFault.exe	85
1884	2868	WerFault.exe	85
3864	2868	WerFault.exe	85

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2868	c1376706f74874c77d93d38af6bfc6addaea16106466be1493c0f1ef9837dcc5.exe
2868	c1376706f74874c77d93d38af6bfc6addaea16106466be1493c0f1ef9837dcc5.exe
2868	c1376706f74874c77d93d38af6bfc6addaea16106466be1493c0f1ef9837dcc5.exe

C:\Users\Admin\AppData\Local\Temp\c1376706f74874c77d93d38af6bfc6addaea16106466be1493c0f1ef9837dcc5.exe
"C:\Users\Admin\AppData\Local\Temp\c1376706f74874c77d93d38af6bfc6addaea16106466be1493c0f1ef9837dcc5.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 1604
  2⤵
  - Program crash
  PID:3544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 1628
  2⤵
  - Program crash
  PID:1884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 1632
  2⤵
  - Program crash
  PID:3864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2868 -ip 2868
1⤵
PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2868 -ip 2868
1⤵
PID:4148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2868 -ip 2868
1⤵
PID:5012

memory/2868-0-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2868-1-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2868-2-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2868-3-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2868-7-0x0000000003C90000-0x0000000003C91000-memory.dmp

Filesize
4KB

Download
memory/2868-8-0x0000000003C30000-0x0000000003C31000-memory.dmp

Filesize
4KB

Download
memory/2868-10-0x0000000003CA0000-0x0000000003CA1000-memory.dmp

Filesize
4KB

Download
memory/2868-9-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download