blackmoon | 65414d56c71e167a6334e0b803e643ab1e2d0ba780a8c792ce6f70f1cce8c1fa

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 11:56

Target

65414d56c71e167a6334e0b803e643ab1e2d0ba780a8c792ce6f70f1cce8c1fa.dll
Size

403KB
MD5

9121656f2aea69c7978326d457f72eb7
SHA1

de8bb6f26348f9ca172c20d650a819752bd59a6a
SHA256

65414d56c71e167a6334e0b803e643ab1e2d0ba780a8c792ce6f70f1cce8c1fa
SHA512

817e2c60c5e80cc757d5385227f91adba8e4f29576db0bc259bf8b26c8124636e2609d7323877a8e4e5bc2a7cf3a956bb27d8d8b4eba4d3a09b5579e615176bc
SSDEEP

12288:pnaMGSZpx5Y5t8F74BXqIHyuTxpuR3K77dtgC6c3ub4mhF:9aMPDeaXRWRtg83U4

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2208-1-0x0000000010000000-0x00000000100E9000-memory.dmp	family_blackmoon
behavioral1/memory/2208-2-0x0000000010000000-0x00000000100E9000-memory.dmp	family_blackmoon
behavioral1/memory/2208-3-0x0000000010000000-0x00000000100E9000-memory.dmp	family_blackmoon
behavioral1/memory/2208-0-0x0000000010000000-0x00000000100E9000-memory.dmp	family_blackmoon

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2196 2208 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2196	2208	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2228 wrote to memory of 2208	2228	rundll32.exe	rundll32.exe
PID 2228 wrote to memory of 2208	2228	rundll32.exe	rundll32.exe
PID 2228 wrote to memory of 2208	2228	rundll32.exe	rundll32.exe
PID 2228 wrote to memory of 2208	2228	rundll32.exe	rundll32.exe
PID 2228 wrote to memory of 2208	2228	rundll32.exe	rundll32.exe
PID 2228 wrote to memory of 2208	2228	rundll32.exe	rundll32.exe
PID 2228 wrote to memory of 2208	2228	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 2196	2208	rundll32.exe	WerFault.exe
PID 2208 wrote to memory of 2196	2208	rundll32.exe	WerFault.exe
PID 2208 wrote to memory of 2196	2208	rundll32.exe	WerFault.exe
PID 2208 wrote to memory of 2196	2208	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65414d56c71e167a6334e0b803e643ab1e2d0ba780a8c792ce6f70f1cce8c1fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\65414d56c71e167a6334e0b803e643ab1e2d0ba780a8c792ce6f70f1cce8c1fa.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 260
    3⤵
    - Program crash
    PID:2196

memory/2208-1-0x0000000010000000-0x00000000100E9000-memory.dmp

Filesize
932KB

Download
memory/2208-2-0x0000000010000000-0x00000000100E9000-memory.dmp

Filesize
932KB

Download
memory/2208-3-0x0000000010000000-0x00000000100E9000-memory.dmp

Filesize
932KB

Download
memory/2208-0-0x0000000010000000-0x00000000100E9000-memory.dmp

Filesize
932KB

Download
memory/2208-4-0x0000000010000000-0x00000000100E9000-memory.dmp

Filesize
932KB

Download
memory/2208-5-0x00000000100E6000-0x00000000100E7000-memory.dmp

Filesize
4KB

Download
memory/2208-6-0x00000000100E6000-0x00000000100E7000-memory.dmp

Filesize
4KB

Download