blackmoon | 871efa2a77a7c7e2ce8ebef89560a49a4a000290d63501c67e1692199500b48e

Analysis

max time kernel
141s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 05:27

Target

CODM.exe
Size

4.8MB
MD5

6a77f4f02b896e9223cb51001cc2343a
SHA1

31f339b81ddc63d8d6337c913d34196619b6a169
SHA256

871efa2a77a7c7e2ce8ebef89560a49a4a000290d63501c67e1692199500b48e
SHA512

1dcd48c9df76991b0b6da077481f04bdb78866b2948be8561b478c62a29fc30713f6700de12111e33aa011e1cec19f6e99644aae9140566bad28d1d308c2c385
SSDEEP

98304:djXPCVLdCtMqe1GQwr4Edx1FqZRtK4D/ehZfPK2kwwo4cjyAbEBDecQ5ya:FaZdCtXe1GJrT5A/WhZnKOwo4cqnQ5ya

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3536-1-0x0000000000400000-0x0000000000AD2000-memory.dmp	family_blackmoon
behavioral2/memory/3536-3-0x0000000000400000-0x0000000000AD2000-memory.dmp	family_blackmoon

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/3536-0-0x0000000000400000-0x0000000000AD2000-memory.dmp	upx
behavioral2/memory/3536-1-0x0000000000400000-0x0000000000AD2000-memory.dmp	upx
behavioral2/memory/3536-3-0x0000000000400000-0x0000000000AD2000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

CODM.exe

pid process

3536 CODM.exe

pid	process
3536	CODM.exe

C:\Users\Admin\AppData\Local\Temp\CODM.exe
"C:\Users\Admin\AppData\Local\Temp\CODM.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3536

memory/3536-0-0x0000000000400000-0x0000000000AD2000-memory.dmp

Filesize
6.8MB

Download
memory/3536-1-0x0000000000400000-0x0000000000AD2000-memory.dmp

Filesize
6.8MB

Download
memory/3536-3-0x0000000000400000-0x0000000000AD2000-memory.dmp

Filesize
6.8MB

Download