blackmoon | 51e19e9783b786a432472ea696219e28feb7ab579097a978f37eab10b1882970

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 01:58

Target

2a972e30c33169f712b594c218737336_JaffaCakes118.dll
Size

80KB
MD5

2a972e30c33169f712b594c218737336
SHA1

2243f605e4312e6d26b4a9fcd1bf9c70de61348d
SHA256

51e19e9783b786a432472ea696219e28feb7ab579097a978f37eab10b1882970
SHA512

3c20f8f7b78c012e9b99a94d23aa4cc87772660f03860e0a4cc9b74119d5fc1aeaa8c15f021ab223e8b96e898089c9e7cac0dc0332d3120e7d6507ac2a813bce
SSDEEP

768:/MFz18Cn+Im/aVtQeUMQ9adrsa2Vru5dCnrcqbGfzHWxZ:e/m/2tFUMRdrV2VydCrhSfyxZ

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

resource	yara_rule
behavioral2/memory/3540-0-0x0000000010000000-0x0000000010014000-memory.dmp	family_blackmoon
behavioral2/memory/3540-1-0x0000000010000000-0x0000000010014000-memory.dmp	family_blackmoon

Blocklisted process makes network request 31 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 3540	440	rundll32.exe	83
PID 440 wrote to memory of 3540	440	rundll32.exe	83
PID 440 wrote to memory of 3540	440	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a972e30c33169f712b594c218737336_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a972e30c33169f712b594c218737336_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:3540

memory/3540-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/3540-1-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download