blackmoon | 65414d56c71e167a6334e0b803e643ab1e2d0ba780a8c792ce6f70f1cce8c1fa

Analysis

max time kernel
128s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 11:56

Target

65414d56c71e167a6334e0b803e643ab1e2d0ba780a8c792ce6f70f1cce8c1fa.dll
Size

403KB
MD5

9121656f2aea69c7978326d457f72eb7
SHA1

de8bb6f26348f9ca172c20d650a819752bd59a6a
SHA256

65414d56c71e167a6334e0b803e643ab1e2d0ba780a8c792ce6f70f1cce8c1fa
SHA512

817e2c60c5e80cc757d5385227f91adba8e4f29576db0bc259bf8b26c8124636e2609d7323877a8e4e5bc2a7cf3a956bb27d8d8b4eba4d3a09b5579e615176bc
SSDEEP

12288:pnaMGSZpx5Y5t8F74BXqIHyuTxpuR3K77dtgC6c3ub4mhF:9aMPDeaXRWRtg83U4

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5020-0-0x0000000010000000-0x00000000100E9000-memory.dmp	family_blackmoon
behavioral2/memory/5020-1-0x0000000010000000-0x00000000100E9000-memory.dmp	family_blackmoon

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4588 5020 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4588	5020	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4020 wrote to memory of 5020	4020	rundll32.exe	rundll32.exe
PID 4020 wrote to memory of 5020	4020	rundll32.exe	rundll32.exe
PID 4020 wrote to memory of 5020	4020	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65414d56c71e167a6334e0b803e643ab1e2d0ba780a8c792ce6f70f1cce8c1fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\65414d56c71e167a6334e0b803e643ab1e2d0ba780a8c792ce6f70f1cce8c1fa.dll,#1
  2⤵
  PID:5020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 660
    3⤵
    - Program crash
    PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5020 -ip 5020
1⤵
PID:4644

memory/5020-0-0x0000000010000000-0x00000000100E9000-memory.dmp

Filesize
932KB

Download
memory/5020-1-0x0000000010000000-0x00000000100E9000-memory.dmp

Filesize
932KB

Download
memory/5020-2-0x0000000010000000-0x00000000100E9000-memory.dmp

Filesize
932KB

Download