blackmoon | 65414d56c71e167a6334e0b803e643ab1e2d0ba780a8c792ce6f70f1cce8c1fa

Analysis

max time kernel
134s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 07:05

Target

65414d56c71e167a6334e0b803e643ab1e2d0ba780a8c792ce6f70f1cce8c1fa.dll
Size

403KB
MD5

9121656f2aea69c7978326d457f72eb7
SHA1

de8bb6f26348f9ca172c20d650a819752bd59a6a
SHA256

65414d56c71e167a6334e0b803e643ab1e2d0ba780a8c792ce6f70f1cce8c1fa
SHA512

817e2c60c5e80cc757d5385227f91adba8e4f29576db0bc259bf8b26c8124636e2609d7323877a8e4e5bc2a7cf3a956bb27d8d8b4eba4d3a09b5579e615176bc
SSDEEP

12288:pnaMGSZpx5Y5t8F74BXqIHyuTxpuR3K77dtgC6c3ub4mhF:9aMPDeaXRWRtg83U4

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4444-0-0x0000000010000000-0x00000000100E9000-memory.dmp	family_blackmoon
behavioral2/memory/4444-1-0x0000000010000000-0x00000000100E9000-memory.dmp	family_blackmoon
behavioral2/memory/4444-2-0x0000000010000000-0x00000000100E9000-memory.dmp	family_blackmoon

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1748 4444 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1748	4444	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4940 wrote to memory of 4444	4940	rundll32.exe	rundll32.exe
PID 4940 wrote to memory of 4444	4940	rundll32.exe	rundll32.exe
PID 4940 wrote to memory of 4444	4940	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65414d56c71e167a6334e0b803e643ab1e2d0ba780a8c792ce6f70f1cce8c1fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4940

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65414d56c71e167a6334e0b803e643ab1e2d0ba780a8c792ce6f70f1cce8c1fa.dll,#1
2⤵
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 668
3⤵
- Program crash
PID:1748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4444 -ip 4444
1⤵
PID:2876

memory/4444-0-0x0000000010000000-0x00000000100E9000-memory.dmp

Filesize
932KB

Download
memory/4444-1-0x0000000010000000-0x00000000100E9000-memory.dmp

Filesize
932KB

Download
memory/4444-2-0x0000000010000000-0x00000000100E9000-memory.dmp

Filesize
932KB

Download