blackmoon | 4ba17b5f96d3d264ce6422ab0d2712ae82e8acb68dabf8430f66006b30e3fa13

Analysis

max time kernel
136s
max time network
141s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 14:32

Target

39855f213e82660888352fe31f529dc9_JaffaCakes118.dll
Size

80KB
MD5

39855f213e82660888352fe31f529dc9
SHA1

97aceb9ed8a836ecb5ee85aedf54056185191923
SHA256

4ba17b5f96d3d264ce6422ab0d2712ae82e8acb68dabf8430f66006b30e3fa13
SHA512

02be4d418f265cff7800de61c7ada7273136aa3cdb6f379eaa4ef46982a9d8682a6afe2704d83084d1adbff121751eb16215b2ba9aec597a0bf567f6840bcc1e
SSDEEP

768:+MFz18Cn+Im/aVtQeUMQ9adrea2Vru5dCnrcqbGfzHWxZ:3/m/2tFUMRdrX2VydCrhSfyxZ

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

resource	yara_rule
behavioral1/memory/2376-0-0x0000000010000000-0x0000000010014000-memory.dmp	family_blackmoon
behavioral1/memory/2376-17-0x0000000010000000-0x0000000010014000-memory.dmp	family_blackmoon

Blocklisted process makes network request 3 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2376	3032	rundll32.exe	30
PID 3032 wrote to memory of 2376	3032	rundll32.exe	30
PID 3032 wrote to memory of 2376	3032	rundll32.exe	30
PID 3032 wrote to memory of 2376	3032	rundll32.exe	30
PID 3032 wrote to memory of 2376	3032	rundll32.exe	30
PID 3032 wrote to memory of 2376	3032	rundll32.exe	30
PID 3032 wrote to memory of 2376	3032	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39855f213e82660888352fe31f529dc9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\39855f213e82660888352fe31f529dc9_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:2376

memory/2376-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/2376-17-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download