blackmoon | 4ba17b5f96d3d264ce6422ab0d2712ae82e8acb68dabf8430f66006b30e3fa13

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 14:32

Target

39855f213e82660888352fe31f529dc9_JaffaCakes118.dll
Size

80KB
MD5

39855f213e82660888352fe31f529dc9
SHA1

97aceb9ed8a836ecb5ee85aedf54056185191923
SHA256

4ba17b5f96d3d264ce6422ab0d2712ae82e8acb68dabf8430f66006b30e3fa13
SHA512

02be4d418f265cff7800de61c7ada7273136aa3cdb6f379eaa4ef46982a9d8682a6afe2704d83084d1adbff121751eb16215b2ba9aec597a0bf567f6840bcc1e
SSDEEP

768:+MFz18Cn+Im/aVtQeUMQ9adrea2Vru5dCnrcqbGfzHWxZ:3/m/2tFUMRdrX2VydCrhSfyxZ

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

resource	yara_rule
behavioral2/memory/4636-0-0x0000000010000000-0x0000000010014000-memory.dmp	family_blackmoon
behavioral2/memory/4636-1-0x0000000010000000-0x0000000010014000-memory.dmp	family_blackmoon

Blocklisted process makes network request 26 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 4636	2636	rundll32.exe	83
PID 2636 wrote to memory of 4636	2636	rundll32.exe	83
PID 2636 wrote to memory of 4636	2636	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39855f213e82660888352fe31f529dc9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\39855f213e82660888352fe31f529dc9_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:4636

memory/4636-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/4636-1-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download