blackmoon | 00c28885f9f24c7ea2f2846a1fe26c01d4e5adbe6a67d5e93f9f0d7e87b990d3

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 18:07

Target

00c28885f9f24c7ea2f2846a1fe26c01d4e5adbe6a67d5e93f9f0d7e87b990d3.exe
Size

4.5MB
MD5

6053aaa74236170b3b6e4604e377e0b5
SHA1

1983a0e088727ee5ceaa0386de81f08e8dddd022
SHA256

00c28885f9f24c7ea2f2846a1fe26c01d4e5adbe6a67d5e93f9f0d7e87b990d3
SHA512

cb0dd2dcd0a97fcaf65153e5ca54d3bd3d19bc22c8e507571f2f1a5f2b8be9f944ee1ef3d14a62eb503cabe0f2041b8193b7562ac22ea6ea6422859f10e854b3
SSDEEP

98304:hS5bmig2VCnxwWFUYTY25p/Fmj6dcKgosI10K991TOvFKlz1us3iYzW:WbBQnywfjFme+rodyQAKlwy

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\jab.jabnop	family_blackmoon
behavioral1/memory/1852-19-0x0000000000400000-0x0000000000891000-memory.dmp	family_blackmoon
behavioral1/memory/856-33-0x0000000000400000-0x0000000000891000-memory.dmp	family_blackmoon

UPX dump on OEP (original entry point) 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1852-4-0x0000000002B10000-0x00000000031F6000-memory.dmp	UPX
behavioral1/memory/1852-9-0x0000000002B10000-0x00000000031F6000-memory.dmp	UPX
behavioral1/memory/1852-20-0x0000000002B10000-0x00000000031F6000-memory.dmp	UPX
behavioral1/memory/856-26-0x0000000002A70000-0x0000000003156000-memory.dmp	UPX
behavioral1/memory/856-30-0x0000000002A70000-0x0000000003156000-memory.dmp	UPX
behavioral1/memory/856-32-0x0000000002A70000-0x0000000003156000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

Processes:

jab.jabnop

pid process

856 jab.jabnop

pid	process
856	jab.jabnop

Loads dropped DLL 2 IoCs

Processes:

00c28885f9f24c7ea2f2846a1fe26c01d4e5adbe6a67d5e93f9f0d7e87b990d3.exe

pid	process
1852	00c28885f9f24c7ea2f2846a1fe26c01d4e5adbe6a67d5e93f9f0d7e87b990d3.exe
1852	00c28885f9f24c7ea2f2846a1fe26c01d4e5adbe6a67d5e93f9f0d7e87b990d3.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

00c28885f9f24c7ea2f2846a1fe26c01d4e5adbe6a67d5e93f9f0d7e87b990d3.exe

pid process

1852 00c28885f9f24c7ea2f2846a1fe26c01d4e5adbe6a67d5e93f9f0d7e87b990d3.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

00c28885f9f24c7ea2f2846a1fe26c01d4e5adbe6a67d5e93f9f0d7e87b990d3.exe

description	pid	process	target process
PID 1852 wrote to memory of 856	1852	00c28885f9f24c7ea2f2846a1fe26c01d4e5adbe6a67d5e93f9f0d7e87b990d3.exe	jab.jabnop
PID 1852 wrote to memory of 856	1852	00c28885f9f24c7ea2f2846a1fe26c01d4e5adbe6a67d5e93f9f0d7e87b990d3.exe	jab.jabnop
PID 1852 wrote to memory of 856	1852	00c28885f9f24c7ea2f2846a1fe26c01d4e5adbe6a67d5e93f9f0d7e87b990d3.exe	jab.jabnop
PID 1852 wrote to memory of 856	1852	00c28885f9f24c7ea2f2846a1fe26c01d4e5adbe6a67d5e93f9f0d7e87b990d3.exe	jab.jabnop

C:\Users\Admin\AppData\Local\Temp\jab.jabnop
C:\Users\Admin\AppData\Local\Temp\jab.jabnop --
2⤵
- Executes dropped EXE
PID:856

\Users\Admin\AppData\Local\Temp\jab.jabnop

Filesize
4.5MB

MD5
cd9e815cc1bc2b83aed8a2b536877dff

SHA1
d0d4c24b3ef8a108b38cc9e54e64573033a7bd85

SHA256
3f882f5776864a8f6b2f2d875d385f96cd012998fe59efca850b04150aa39f60

SHA512
40cb4be92599d9b5fea47beed2c9d838b478b780f788f7c421bffbf09fe56ee5014436a5aee159052179015a80138aed1a6362a275e53ccbbe5b0c68b421d301

Download Submit
memory/856-24-0x0000000002A70000-0x0000000003156000-memory.dmp

Filesize
6.9MB

Download
memory/856-26-0x0000000002A70000-0x0000000003156000-memory.dmp

Filesize
6.9MB

Download
memory/856-30-0x0000000002A70000-0x0000000003156000-memory.dmp

Filesize
6.9MB

Download
memory/856-32-0x0000000002A70000-0x0000000003156000-memory.dmp

Filesize
6.9MB

Download
memory/856-33-0x0000000000400000-0x0000000000891000-memory.dmp

Filesize
4.6MB

Download
memory/1852-2-0x0000000002B10000-0x00000000031F6000-memory.dmp

Filesize
6.9MB

Download
memory/1852-4-0x0000000002B10000-0x00000000031F6000-memory.dmp

Filesize
6.9MB

Download
memory/1852-9-0x0000000002B10000-0x00000000031F6000-memory.dmp

Filesize
6.9MB

Download
memory/1852-20-0x0000000002B10000-0x00000000031F6000-memory.dmp

Filesize
6.9MB

Download
memory/1852-19-0x0000000000400000-0x0000000000891000-memory.dmp

Filesize
4.6MB

Download