blackmoon | fcef1a5b4190080aa53a2d2c4f462bcf1be38f9af91847bc8530b4f5b0c86275

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 20:39

Target

fcef1a5b4190080aa53a2d2c4f462bcf1be38f9af91847bc8530b4f5b0c86275.dll
Size

399KB
MD5

63e8ea821ef09d3d90f4258320850c7d
SHA1

168b7f31763a6b2ac7339f42ab445b24ff8bbb3a
SHA256

fcef1a5b4190080aa53a2d2c4f462bcf1be38f9af91847bc8530b4f5b0c86275
SHA512

65a1dbf3838e097a13b41dfe351ca5233d9e28670261933e2abe9d85012c4e611e3c7351e592051b1f117dd0bd67211e9978958a0a1a30a4238be0e326841ea1
SSDEEP

12288:xJxHrEuEbb7chQXAv1Zhd98r61tZzfcA:xzrDAwhQEThdr1D

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3068-0-0x0000000010000000-0x00000000100E6000-memory.dmp	family_blackmoon
behavioral1/memory/3068-3-0x0000000010000000-0x00000000100E6000-memory.dmp	family_blackmoon
behavioral1/memory/3068-2-0x0000000010000000-0x00000000100E6000-memory.dmp	family_blackmoon
behavioral1/memory/3068-1-0x0000000010000000-0x00000000100E6000-memory.dmp	family_blackmoon
behavioral1/memory/3068-4-0x0000000010000000-0x00000000100E6000-memory.dmp	family_blackmoon

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2684 3068 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2684	3068	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2276 wrote to memory of 3068	2276	rundll32.exe	rundll32.exe
PID 2276 wrote to memory of 3068	2276	rundll32.exe	rundll32.exe
PID 2276 wrote to memory of 3068	2276	rundll32.exe	rundll32.exe
PID 2276 wrote to memory of 3068	2276	rundll32.exe	rundll32.exe
PID 2276 wrote to memory of 3068	2276	rundll32.exe	rundll32.exe
PID 2276 wrote to memory of 3068	2276	rundll32.exe	rundll32.exe
PID 2276 wrote to memory of 3068	2276	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 2684	3068	rundll32.exe	WerFault.exe
PID 3068 wrote to memory of 2684	3068	rundll32.exe	WerFault.exe
PID 3068 wrote to memory of 2684	3068	rundll32.exe	WerFault.exe
PID 3068 wrote to memory of 2684	3068	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fcef1a5b4190080aa53a2d2c4f462bcf1be38f9af91847bc8530b4f5b0c86275.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fcef1a5b4190080aa53a2d2c4f462bcf1be38f9af91847bc8530b4f5b0c86275.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 260
3⤵
- Program crash
PID:2684

memory/3068-0-0x0000000010000000-0x00000000100E6000-memory.dmp

Filesize
920KB

Download
memory/3068-3-0x0000000010000000-0x00000000100E6000-memory.dmp

Filesize
920KB

Download
memory/3068-2-0x0000000010000000-0x00000000100E6000-memory.dmp

Filesize
920KB

Download
memory/3068-1-0x0000000010000000-0x00000000100E6000-memory.dmp

Filesize
920KB

Download
memory/3068-4-0x0000000010000000-0x00000000100E6000-memory.dmp

Filesize
920KB

Download
memory/3068-5-0x0000000000240000-0x000000000029B000-memory.dmp

Filesize
364KB

Download