blackmoon | d687f173fc8cb840f78636d25b0a7c684b41efc139e8fbfeec4c6ea893134e32

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 04:50

Target
a3dfed5712b93fc16f90e619bf8584b5_JaffaCakes118.dll
Size 127KB
Sample240613-fgplfaycmq
SHA256 d687f173fc8cb840f78636d25b0a7c684b41efc139e8fbfeec4c6ea893134e32
MD5 a3dfed5712b93fc16f90e619bf8584b5
SHA1 98634a6ee70ad3e3f66f31b580e10ce1981d3273
SHA512 b69bccd24c3e31c751e50e1372e9447df5c993a8006f25cc9e5144949e86f86a8a1f48d921a05b055d9503ada53e9323cddba3681fe3e788eb127d4ac77f6904
SSDEEP 3072:wuRCZaKwZLEEPfnk7e7odkpqJoFSym3xKDbz8/bAwout:wuRxKw3PfyOo6fsymByzgAwoS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral2/memory/1136-0-0x0000000010000000-0x0000000010100000-memory.dmp	family_blackmoon

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1136-0-0x0000000010000000-0x0000000010100000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 1136	4788	rundll32.exe	82
PID 4788 wrote to memory of 1136	4788	rundll32.exe	82
PID 4788 wrote to memory of 1136	4788	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3dfed5712b93fc16f90e619bf8584b5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3dfed5712b93fc16f90e619bf8584b5_JaffaCakes118.dll,#1
  2⤵
  PID:1136

memory/1136-0-0x0000000010000000-0x0000000010100000-memory.dmp

Download