blackmoon | 51e19e9783b786a432472ea696219e28feb7ab579097a978f37eab10b1882970

Analysis

max time kernel
146s
max time network
153s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 01:58

Target

2a972e30c33169f712b594c218737336_JaffaCakes118.dll
Size

80KB
MD5

2a972e30c33169f712b594c218737336
SHA1

2243f605e4312e6d26b4a9fcd1bf9c70de61348d
SHA256

51e19e9783b786a432472ea696219e28feb7ab579097a978f37eab10b1882970
SHA512

3c20f8f7b78c012e9b99a94d23aa4cc87772660f03860e0a4cc9b74119d5fc1aeaa8c15f021ab223e8b96e898089c9e7cac0dc0332d3120e7d6507ac2a813bce
SSDEEP

768:/MFz18Cn+Im/aVtQeUMQ9adrsa2Vru5dCnrcqbGfzHWxZ:e/m/2tFUMRdrV2VydCrhSfyxZ

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

resource	yara_rule
behavioral1/memory/1796-0-0x0000000010000000-0x0000000010014000-memory.dmp	family_blackmoon
behavioral1/memory/1796-19-0x0000000010000000-0x0000000010014000-memory.dmp	family_blackmoon

Blocklisted process makes network request 3 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 1796	2064	rundll32.exe	29
PID 2064 wrote to memory of 1796	2064	rundll32.exe	29
PID 2064 wrote to memory of 1796	2064	rundll32.exe	29
PID 2064 wrote to memory of 1796	2064	rundll32.exe	29
PID 2064 wrote to memory of 1796	2064	rundll32.exe	29
PID 2064 wrote to memory of 1796	2064	rundll32.exe	29
PID 2064 wrote to memory of 1796	2064	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a972e30c33169f712b594c218737336_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a972e30c33169f712b594c218737336_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:1796

memory/1796-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/1796-19-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download