blackmoon | c36be1f8258236caaa5c0b0098aee46a516abe69d8e4c9a7f9a68cf166e88a33

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 23:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c36be1f8258236caaa5c0b0098aee46a516abe69d8e4c9a7f9a68cf166e88a33.exe
Size

12.0MB
MD5

70eea6793a54bf70b0b21a1b71628db5
SHA1

3a945d2cca69e4f77a517f28950f276e923671c0
SHA256

c36be1f8258236caaa5c0b0098aee46a516abe69d8e4c9a7f9a68cf166e88a33
SHA512

1126ceb4b2ffa425afda6ebf34b0041f9d7295dc37bab1ecb3d114e93c687d6256b1247298447c728314de6915451b186a6447df309e8acf2b70aec475f5a619
SSDEEP

196608:FmBGRP4hinoELBn8M9wr+weWKBT0CYjD0LAif8dxVK1W2HfALaCIwZrFKTNeFpPW:FmtInxJ8MfzWQ0pjAXa0hfA1whev

Score

10^/10

blackmoon banker trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2200-39-0x0000000000400000-0x0000000001904000-memory.dmp	family_blackmoon
behavioral1/memory/2200-40-0x0000000000400000-0x0000000001904000-memory.dmp	family_blackmoon
behavioral1/memory/2200-41-0x0000000000400000-0x0000000001904000-memory.dmp	family_blackmoon
behavioral1/memory/2200-42-0x0000000000400000-0x0000000001904000-memory.dmp	family_blackmoon
behavioral1/memory/2200-43-0x0000000000400000-0x0000000001904000-memory.dmp	family_blackmoon
behavioral1/memory/2200-45-0x0000000000400000-0x0000000001904000-memory.dmp	family_blackmoon
behavioral1/memory/2200-47-0x0000000000400000-0x0000000001904000-memory.dmp	family_blackmoon

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2200-44-0x0000000003290000-0x00000000032C6000-memory.dmp	upx
behavioral1/memory/2200-46-0x0000000003290000-0x00000000032C6000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

c36be1f8258236caaa5c0b0098aee46a516abe69d8e4c9a7f9a68cf166e88a33.exe

pid process

2200 c36be1f8258236caaa5c0b0098aee46a516abe69d8e4c9a7f9a68cf166e88a33.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

c36be1f8258236caaa5c0b0098aee46a516abe69d8e4c9a7f9a68cf166e88a33.exe

pid	process
2200	c36be1f8258236caaa5c0b0098aee46a516abe69d8e4c9a7f9a68cf166e88a33.exe
2200	c36be1f8258236caaa5c0b0098aee46a516abe69d8e4c9a7f9a68cf166e88a33.exe

C:\Users\Admin\AppData\Local\Temp\c36be1f8258236caaa5c0b0098aee46a516abe69d8e4c9a7f9a68cf166e88a33.exe
"C:\Users\Admin\AppData\Local\Temp\c36be1f8258236caaa5c0b0098aee46a516abe69d8e4c9a7f9a68cf166e88a33.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2200

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2200-20-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2200-18-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2200-25-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2200-23-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2200-35-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2200-33-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2200-39-0x0000000000400000-0x0000000001904000-memory.dmp

Filesize
21.0MB

Download
memory/2200-30-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2200-40-0x0000000000400000-0x0000000001904000-memory.dmp

Filesize
21.0MB

Download
memory/2200-28-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2200-15-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2200-13-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2200-11-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2200-10-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2200-8-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2200-6-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2200-5-0x00000000006E1000-0x0000000000CFB000-memory.dmp

Filesize
6.1MB

Download
memory/2200-4-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2200-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2200-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2200-41-0x0000000000400000-0x0000000001904000-memory.dmp

Filesize
21.0MB

Download
memory/2200-42-0x0000000000400000-0x0000000001904000-memory.dmp

Filesize
21.0MB

Download
memory/2200-43-0x0000000000400000-0x0000000001904000-memory.dmp

Filesize
21.0MB

Download
memory/2200-44-0x0000000003290000-0x00000000032C6000-memory.dmp

Filesize
216KB

Download
memory/2200-45-0x0000000000400000-0x0000000001904000-memory.dmp

Filesize
21.0MB

Download
memory/2200-46-0x0000000003290000-0x00000000032C6000-memory.dmp

Filesize
216KB

Download
memory/2200-47-0x0000000000400000-0x0000000001904000-memory.dmp

Filesize
21.0MB

Download
memory/2200-48-0x00000000006E1000-0x0000000000CFB000-memory.dmp

Filesize
6.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads