blackmoon | 7ece36a08ac1adc066aa6744abfcdef371aef199198a5c912d029d58b7fbd8f9

Analysis

max time kernel
54s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 05:14

Target

F2.exe
Size

4.8MB
MD5

eb083f32e116fa593f695e4e87782b25
SHA1

37ba5ae08b28bde975619da08f4acd6c0c619a89
SHA256

7ece36a08ac1adc066aa6744abfcdef371aef199198a5c912d029d58b7fbd8f9
SHA512

2dddddc342240409a241825f6ea165db0c64daff2802f4342f6a4a64123399eacd1df207a822da24e80bf0b8327ce533245c4a11ad0363897a7c42216954b19b
SSDEEP

98304:2XNyuU8lMIeiizLIXL5c+PU3Mbbw4n8ywFRhVPNW7w:2Ny/8jyMXL3rUS6Rew

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3492-1-0x0000000000400000-0x0000000000AD4000-memory.dmp	family_blackmoon
behavioral2/memory/3492-12-0x0000000000400000-0x0000000000AD4000-memory.dmp	family_blackmoon

pid	process
3492	F2.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/3492-0-0x0000000000400000-0x0000000000AD4000-memory.dmp	upx
behavioral2/memory/3492-1-0x0000000000400000-0x0000000000AD4000-memory.dmp	upx
behavioral2/memory/3492-12-0x0000000000400000-0x0000000000AD4000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

Processes:

F2.exe

description ioc process

File created C:\Windows\Dll2.dll F2.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

F2.exe

pid process

3492 F2.exe
3492 F2.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

F2.exedwm.exe

description pid process

Token: SeDebugPrivilege 3492 F2.exe
Token: SeShutdownPrivilege 64 dwm.exe
Token: SeCreatePagefilePrivilege 64 dwm.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

F2.exe

pid process

3492 F2.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

F2.exe

description pid process target process

PID 3492 wrote to memory of 64 3492 F2.exe dwm.exe
PID 3492 wrote to memory of 64 3492 F2.exe dwm.exe

description	ioc	process
File created	C:\Windows\Dll2.dll	F2.exe

pid	process
3492	F2.exe
3492	F2.exe

description	pid	process
Token: SeDebugPrivilege	3492	F2.exe
Token: SeShutdownPrivilege	64	dwm.exe
Token: SeCreatePagefilePrivilege	64	dwm.exe

pid	process
3492	F2.exe

description	pid	process	target process
PID 3492 wrote to memory of 64	3492	F2.exe	dwm.exe
PID 3492 wrote to memory of 64	3492	F2.exe	dwm.exe

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:64

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3932,i,3833046924978547022,12404847742964713612,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
1⤵
PID:4020

C:\Windows\Dll2.dll
Filesize
154KB

MD5
6206e7bd72ee6c7df5e2a13b19a05303

SHA1
88260d9da5e75ae2aa7d4a671de0e1807ebf006d

SHA256
0f63d0cdd05e5308a25e9414136bbc2d1898ea3cfda9388d5af1796b47d40106

SHA512
85d93562567eeea776f9aeb618ecd5ffcf936d04fc2303aea7c1d36cb446231fb56ff529cf7449e639fe8966d51571607875ac5ae63757e00aded368da70998b

Download Submit
memory/64-9-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/64-11-0x00000197A5410000-0x00000197A5548000-memory.dmp

Filesize
1.2MB

Download
memory/64-14-0x00000197A5410000-0x00000197A5548000-memory.dmp

Filesize
1.2MB

Download
memory/3492-0-0x0000000000400000-0x0000000000AD4000-memory.dmp

Filesize
6.8MB

Download
memory/3492-1-0x0000000000400000-0x0000000000AD4000-memory.dmp

Filesize
6.8MB

Download
memory/3492-12-0x0000000000400000-0x0000000000AD4000-memory.dmp

Filesize
6.8MB

Download