blackmoon | 65414d56c71e167a6334e0b803e643ab1e2d0ba780a8c792ce6f70f1cce8c1fa

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 07:05

Target

65414d56c71e167a6334e0b803e643ab1e2d0ba780a8c792ce6f70f1cce8c1fa.dll
Size

403KB
MD5

9121656f2aea69c7978326d457f72eb7
SHA1

de8bb6f26348f9ca172c20d650a819752bd59a6a
SHA256

65414d56c71e167a6334e0b803e643ab1e2d0ba780a8c792ce6f70f1cce8c1fa
SHA512

817e2c60c5e80cc757d5385227f91adba8e4f29576db0bc259bf8b26c8124636e2609d7323877a8e4e5bc2a7cf3a956bb27d8d8b4eba4d3a09b5579e615176bc
SSDEEP

12288:pnaMGSZpx5Y5t8F74BXqIHyuTxpuR3K77dtgC6c3ub4mhF:9aMPDeaXRWRtg83U4

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2328-1-0x0000000010000000-0x00000000100E9000-memory.dmp	family_blackmoon
behavioral1/memory/2328-2-0x0000000010000000-0x00000000100E9000-memory.dmp	family_blackmoon
behavioral1/memory/2328-0-0x0000000010000000-0x00000000100E9000-memory.dmp	family_blackmoon

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1244 2328 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1244	2328	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2184 wrote to memory of 2328	2184	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 2328	2184	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 2328	2184	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 2328	2184	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 2328	2184	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 2328	2184	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 2328	2184	rundll32.exe	rundll32.exe
PID 2328 wrote to memory of 1244	2328	rundll32.exe	WerFault.exe
PID 2328 wrote to memory of 1244	2328	rundll32.exe	WerFault.exe
PID 2328 wrote to memory of 1244	2328	rundll32.exe	WerFault.exe
PID 2328 wrote to memory of 1244	2328	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65414d56c71e167a6334e0b803e643ab1e2d0ba780a8c792ce6f70f1cce8c1fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65414d56c71e167a6334e0b803e643ab1e2d0ba780a8c792ce6f70f1cce8c1fa.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 260
3⤵
- Program crash
PID:1244

memory/2328-1-0x0000000010000000-0x00000000100E9000-memory.dmp

Filesize
932KB

Download
memory/2328-3-0x0000000010000000-0x00000000100E9000-memory.dmp

Filesize
932KB

Download
memory/2328-2-0x0000000010000000-0x00000000100E9000-memory.dmp

Filesize
932KB

Download
memory/2328-0-0x0000000010000000-0x00000000100E9000-memory.dmp

Filesize
932KB

Download
memory/2328-4-0x00000000100E6000-0x00000000100E7000-memory.dmp

Filesize
4KB

Download
memory/2328-5-0x00000000100E6000-0x00000000100E7000-memory.dmp

Filesize
4KB

Download