blackmoon | c6a193a5fd942f641d537dc5a87504f0b25960a151e8bb91161aabe8428fb191

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 06:17

Target

c6a193a5fd942f641d537dc5a87504f0b25960a151e8bb91161aabe8428fb191.exe
Size

143KB
MD5

2284c40e424997afa0addce43307bdb1
SHA1

f65cdaf65ae742a5a34600e5720467caf7fae16c
SHA256

c6a193a5fd942f641d537dc5a87504f0b25960a151e8bb91161aabe8428fb191
SHA512

6be76918bc16b878f1fbaff171bf0477ff2f6ce188f876975ab5519b430b79037aace5615668084c7acbfb08540f90131ad67a14a896618729f924491320aec4
SSDEEP

3072:WjXwEWM4yT8O3FayAPNrobQwmLfZBKKxvVv9+V12W+lLxAVpbxt:WE5LyT8O3FazNr+QjrPXxvVV+GD4pbxt

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2820-1-0x0000000000400000-0x00000000004C1000-memory.dmp	family_blackmoon
behavioral1/memory/2820-4-0x0000000000400000-0x00000000004C1000-memory.dmp	family_blackmoon

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

c6a193a5fd942f641d537dc5a87504f0b25960a151e8bb91161aabe8428fb191.exe

pid process

2820 c6a193a5fd942f641d537dc5a87504f0b25960a151e8bb91161aabe8428fb191.exe

pid	process
2820	c6a193a5fd942f641d537dc5a87504f0b25960a151e8bb91161aabe8428fb191.exe

C:\Users\Admin\AppData\Local\Temp\c6a193a5fd942f641d537dc5a87504f0b25960a151e8bb91161aabe8428fb191.exe
"C:\Users\Admin\AppData\Local\Temp\c6a193a5fd942f641d537dc5a87504f0b25960a151e8bb91161aabe8428fb191.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2820

memory/2820-0-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2820-1-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2820-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2820-4-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2820-5-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download