blackmoon | cbaad53a7840cb29eafb2f20454db04de91af0367241d637840c69543ae2d5a6

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 01:38

Target
cbaad53a7840cb29eafb2f20454db04de91af0367241d637840c69543ae2d5a6.dll
Size 356KB
Sample240612-b2pdysxhpk
SHA256 cbaad53a7840cb29eafb2f20454db04de91af0367241d637840c69543ae2d5a6
MD5 a3ee5a74a794d15699abaf06ec579feb
SHA1 4e4aaef010e517426d611f1ba8b762b82817d1d0
SHA512 b59f27b7fc320937b936aaf52cb1a68f353617b20beb28ae1080615885bf25fef72b61779caf3474c0166cb10e8ba08924b542205f7311bd6976fba244ff1254
SSDEEP 6144:SqNI/3r26EmP9neq5dtYplpLQylmaGKBpaWVdBXqLyNkVc/FPrvZntbtwfoS:SqNI/3CyPte+CldQydTNq+0cJrxwfoS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral2/memory/4204-2-0x00000000755E0000-0x00000000757C4000-memory.dmp	family_blackmoon

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4204-0-0x00000000755E0000-0x00000000757C4000-memory.dmp	upx
behavioral2/memory/4204-2-0x00000000755E0000-0x00000000757C4000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4196	4204	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 4204	1988	rundll32.exe	79
PID 1988 wrote to memory of 4204	1988	rundll32.exe	79
PID 1988 wrote to memory of 4204	1988	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbaad53a7840cb29eafb2f20454db04de91af0367241d637840c69543ae2d5a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbaad53a7840cb29eafb2f20454db04de91af0367241d637840c69543ae2d5a6.dll,#1
  2⤵
  PID:4204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 680
    3⤵
    - Program crash
    PID:4196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4204 -ip 4204
1⤵
PID:4412

memory/4204-0-0x00000000755E0000-0x00000000757C4000-memory.dmp

Download

memory/4204-2-0x00000000755E0000-0x00000000757C4000-memory.dmp

Download