blackmoon | 1d6e9ba03acaaa0150224b454433343d83887fa4b90ced2b9a2a8e738e5ed474

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 11:13

Target

1d6e9ba03acaaa0150224b454433343d83887fa4b90ced2b9a2a8e738e5ed474.exe
Size

2.0MB
MD5

f3bbdd01c6992f8855194f119aafb5de
SHA1

8a7b40121209dfbd01877d2e44e55b41465f6e27
SHA256

1d6e9ba03acaaa0150224b454433343d83887fa4b90ced2b9a2a8e738e5ed474
SHA512

473adc67760c62d479843c2c19c3892e27bb477de267297d2e1ab70d7cf6c6ee21a71bf4c7a0ac86bccc8486967e4507397fc3c1b855a4dadeae1e829f3011c7
SSDEEP

49152:3LzrbFxc/JtgodtixHsTB+yYXqOXhjCWYmhClirTPhZxff:bLYPDPixHsTBqXhjhClit

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 4 IoCs

resource	yara_rule
behavioral2/memory/920-1-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/920-2-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/920-3-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/920-10-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1508	920	WerFault.exe	84
2612	920	WerFault.exe	84
4248	920	WerFault.exe	84

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
920	1d6e9ba03acaaa0150224b454433343d83887fa4b90ced2b9a2a8e738e5ed474.exe
920	1d6e9ba03acaaa0150224b454433343d83887fa4b90ced2b9a2a8e738e5ed474.exe
920	1d6e9ba03acaaa0150224b454433343d83887fa4b90ced2b9a2a8e738e5ed474.exe

C:\Users\Admin\AppData\Local\Temp\1d6e9ba03acaaa0150224b454433343d83887fa4b90ced2b9a2a8e738e5ed474.exe
"C:\Users\Admin\AppData\Local\Temp\1d6e9ba03acaaa0150224b454433343d83887fa4b90ced2b9a2a8e738e5ed474.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 1604
  2⤵
  - Program crash
  PID:1508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 1628
  2⤵
  - Program crash
  PID:2612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 1612
  2⤵
  - Program crash
  PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 920 -ip 920
1⤵
PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 920 -ip 920
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 920 -ip 920
1⤵
PID:3900

memory/920-0-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/920-1-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/920-2-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/920-3-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/920-8-0x0000000003B50000-0x0000000003B51000-memory.dmp

Filesize
4KB

Download
memory/920-7-0x0000000003FC0000-0x0000000003FC1000-memory.dmp

Filesize
4KB

Download
memory/920-9-0x0000000003FD0000-0x0000000003FD1000-memory.dmp

Filesize
4KB

Download
memory/920-10-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download