blackmoon | 11f718681ff1723d89cd4a7de13c6447f3417f470f695c62006372651e4f4ddb

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11f718681ff1723d89cd4a7de13c6447f3417f470f695c62006372651e4f4ddb.exe
Size

9.2MB
MD5

4d70ea2a3e646d80637741e3d516a0ee
SHA1

683a63aa38ec45ccfe98c867ec7fa3dd9f534746
SHA256

11f718681ff1723d89cd4a7de13c6447f3417f470f695c62006372651e4f4ddb
SHA512

3e12086fd5bec5ee19f880c608146404b426d72bf2f0c6d2225bd0ff907dcadf2d1d3377ad29d0e48450e519ee8bbaea860c28046ad04cb25719fcde1cc08fa0
SSDEEP

196608:Vi0/YuNJ0C4ONeaY0UdLT2xLDTHJc8pYV9UWMTjs5kzwnz0hfb:Vt/rWCdlrUdGxDI4qIj

Score

10^/10

blackmoon banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1968-24-0x0000000010000000-0x000000001027F000-memory.dmp	family_blackmoon
behavioral1/memory/1968-38-0x0000000010000000-0x000000001027F000-memory.dmp	family_blackmoon

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

11f718681ff1723d89cd4a7de13c6447f3417f470f695c62006372651e4f4ddb.exe

pid	process
1968	11f718681ff1723d89cd4a7de13c6447f3417f470f695c62006372651e4f4ddb.exe
1968	11f718681ff1723d89cd4a7de13c6447f3417f470f695c62006372651e4f4ddb.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

11f718681ff1723d89cd4a7de13c6447f3417f470f695c62006372651e4f4ddb.exe

pid process

1968 11f718681ff1723d89cd4a7de13c6447f3417f470f695c62006372651e4f4ddb.exe

C:\Users\Admin\AppData\Local\Temp\11f718681ff1723d89cd4a7de13c6447f3417f470f695c62006372651e4f4ddb.exe
"C:\Users\Admin\AppData\Local\Temp\11f718681ff1723d89cd4a7de13c6447f3417f470f695c62006372651e4f4ddb.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-0-0x0000000000400000-0x00000000019C8000-memory.dmp

Filesize
21.8MB

Download
memory/1968-1-0x0000000076161000-0x0000000076162000-memory.dmp

Filesize
4KB

Download
memory/1968-3-0x0000000076150000-0x0000000076260000-memory.dmp

Filesize
1.1MB

Download
memory/1968-6-0x0000000076150000-0x0000000076260000-memory.dmp

Filesize
1.1MB

Download
memory/1968-8-0x0000000076150000-0x0000000076260000-memory.dmp

Filesize
1.1MB

Download
memory/1968-7-0x0000000076150000-0x0000000076260000-memory.dmp

Filesize
1.1MB

Download
memory/1968-5-0x0000000076150000-0x0000000076260000-memory.dmp

Filesize
1.1MB

Download
memory/1968-21-0x0000000076150000-0x0000000076260000-memory.dmp

Filesize
1.1MB

Download
memory/1968-23-0x0000000076150000-0x0000000076260000-memory.dmp

Filesize
1.1MB

Download
memory/1968-22-0x0000000076150000-0x0000000076260000-memory.dmp

Filesize
1.1MB

Download
memory/1968-20-0x0000000076150000-0x0000000076260000-memory.dmp

Filesize
1.1MB

Download
memory/1968-19-0x0000000076150000-0x0000000076260000-memory.dmp

Filesize
1.1MB

Download
memory/1968-18-0x0000000076150000-0x0000000076260000-memory.dmp

Filesize
1.1MB

Download
memory/1968-17-0x0000000076150000-0x0000000076260000-memory.dmp

Filesize
1.1MB

Download
memory/1968-16-0x0000000076150000-0x0000000076260000-memory.dmp

Filesize
1.1MB

Download
memory/1968-15-0x0000000076150000-0x0000000076260000-memory.dmp

Filesize
1.1MB

Download
memory/1968-14-0x0000000076150000-0x0000000076260000-memory.dmp

Filesize
1.1MB

Download
memory/1968-13-0x0000000076150000-0x0000000076260000-memory.dmp

Filesize
1.1MB

Download
memory/1968-12-0x0000000076150000-0x0000000076260000-memory.dmp

Filesize
1.1MB

Download
memory/1968-11-0x0000000076150000-0x0000000076260000-memory.dmp

Filesize
1.1MB

Download
memory/1968-10-0x0000000076150000-0x0000000076260000-memory.dmp

Filesize
1.1MB

Download
memory/1968-9-0x0000000076150000-0x0000000076260000-memory.dmp

Filesize
1.1MB

Download
memory/1968-4-0x0000000076150000-0x0000000076260000-memory.dmp

Filesize
1.1MB

Download
memory/1968-24-0x0000000010000000-0x000000001027F000-memory.dmp

Filesize
2.5MB

Download
memory/1968-32-0x0000000076150000-0x0000000076260000-memory.dmp

Filesize
1.1MB

Download
memory/1968-33-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1968-35-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1968-37-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1968-38-0x0000000010000000-0x000000001027F000-memory.dmp

Filesize
2.5MB

Download
memory/1968-40-0x0000000000400000-0x00000000019C8000-memory.dmp

Filesize
21.8MB

Download
memory/1968-41-0x0000000076161000-0x0000000076162000-memory.dmp

Filesize
4KB

Download
memory/1968-43-0x0000000000400000-0x00000000019C8000-memory.dmp

Filesize
21.8MB

Download