blackmoon | eb7baf7ae5d0833bc199e262e97160d59c2e3000e57c35ea1ce5904291dc5873

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 16:26

Target

eb7baf7ae5d0833bc199e262e97160d59c2e3000e57c35ea1ce5904291dc5873.exe
Size

6.4MB
MD5

ea1281f6cb7e59fdc45d978570040498
SHA1

0035ed7d0e9e51ab24419da8bb63c7455c27a43f
SHA256

eb7baf7ae5d0833bc199e262e97160d59c2e3000e57c35ea1ce5904291dc5873
SHA512

a8eafbdf6bc09dde3541ab64874da4389f7b7b2e25c85e499388760472d1c5c13a5d15b7fd3b73c1085254b079da31098425f3e7be77dd6cf4e3a90c1217eceb
SSDEEP

98304:ixO9ew5FQ+f+M7bmMYo139JdowJj5gPo7EDTSSNW1IZXojWJkrTB2Vdf8rvK:iw5fR3mMR3ZowJ6gTl1saWEB2P2S

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2696-9-0x0000000000400000-0x0000000001124000-memory.dmp	family_blackmoon
behavioral1/memory/2696-13-0x0000000000400000-0x0000000001124000-memory.dmp	family_blackmoon

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/2696-9-0x0000000000400000-0x0000000001124000-memory.dmp	vmprotect
behavioral1/memory/2696-13-0x0000000000400000-0x0000000001124000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

eb7baf7ae5d0833bc199e262e97160d59c2e3000e57c35ea1ce5904291dc5873.exe

pid process

2696 eb7baf7ae5d0833bc199e262e97160d59c2e3000e57c35ea1ce5904291dc5873.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2516 2696 WerFault.exe eb7baf7ae5d0833bc199e262e97160d59c2e3000e57c35ea1ce5904291dc5873.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

eb7baf7ae5d0833bc199e262e97160d59c2e3000e57c35ea1ce5904291dc5873.exe

pid process

2696 eb7baf7ae5d0833bc199e262e97160d59c2e3000e57c35ea1ce5904291dc5873.exe

pid	pid_target	process	target process
2516	2696	WerFault.exe	eb7baf7ae5d0833bc199e262e97160d59c2e3000e57c35ea1ce5904291dc5873.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

eb7baf7ae5d0833bc199e262e97160d59c2e3000e57c35ea1ce5904291dc5873.exe

pid	process
2696	eb7baf7ae5d0833bc199e262e97160d59c2e3000e57c35ea1ce5904291dc5873.exe
2696	eb7baf7ae5d0833bc199e262e97160d59c2e3000e57c35ea1ce5904291dc5873.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

eb7baf7ae5d0833bc199e262e97160d59c2e3000e57c35ea1ce5904291dc5873.exe

description	pid	process	target process
PID 2696 wrote to memory of 2516	2696	eb7baf7ae5d0833bc199e262e97160d59c2e3000e57c35ea1ce5904291dc5873.exe	WerFault.exe
PID 2696 wrote to memory of 2516	2696	eb7baf7ae5d0833bc199e262e97160d59c2e3000e57c35ea1ce5904291dc5873.exe	WerFault.exe
PID 2696 wrote to memory of 2516	2696	eb7baf7ae5d0833bc199e262e97160d59c2e3000e57c35ea1ce5904291dc5873.exe	WerFault.exe
PID 2696 wrote to memory of 2516	2696	eb7baf7ae5d0833bc199e262e97160d59c2e3000e57c35ea1ce5904291dc5873.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 560
2⤵
- Program crash
PID:2516

memory/2696-0-0x0000000000733000-0x0000000000BC3000-memory.dmp

Filesize
4.6MB

Download
memory/2696-5-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2696-3-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2696-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2696-9-0x0000000000400000-0x0000000001124000-memory.dmp

Filesize
13.1MB

Download
memory/2696-10-0x0000000000310000-0x0000000000312000-memory.dmp

Filesize
8KB

Download
memory/2696-12-0x0000000000733000-0x0000000000BC3000-memory.dmp

Filesize
4.6MB

Download
memory/2696-13-0x0000000000400000-0x0000000001124000-memory.dmp

Filesize
13.1MB

Download