blackmoon | f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 15:32

Target

f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe
Size

10.6MB
MD5

35bfeff634963ed20a003eec45e21d7e
SHA1

d4a5d090b05a0643cc8f01581939f98ba6587fa3
SHA256

f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a
SHA512

ad5bead049e4e518798cddd76cce0d17aeac818dfd1ad71d6da37da112f1d3de51bd7eef2f5af536d63f1734d5ef39755f8658afad0d61e08a47ab4d3447d417
SSDEEP

196608:10/mS2KWUGNEoiN/A4sLhg6jr7fNVIpiNYUpbimDV591R/ioEe3qorBOMSh:iOupGNvLC6jrZVIQNYiumJ/vJaoyh

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon
Detect Blackmoon payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/5060-31-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon

resource	yara_rule
behavioral2/memory/5060-31-0x0000000000400000-0x00000000009FA000-memory.dmp	family_blackmoon

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe

pid	process
5060	f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe
5060	f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe
5060	f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe

C:\Users\Admin\AppData\Local\Temp\f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe
"C:\Users\Admin\AppData\Local\Temp\f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5060

memory/5060-0-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/5060-1-0x0000000000FB0000-0x0000000000FB3000-memory.dmp

Filesize
12KB

Download
memory/5060-5-0x00000000040B0000-0x00000000040B1000-memory.dmp

Filesize
4KB

Download
memory/5060-7-0x00000000040C0000-0x00000000040C1000-memory.dmp

Filesize
4KB

Download
memory/5060-6-0x0000000003F50000-0x0000000003F51000-memory.dmp

Filesize
4KB

Download
memory/5060-31-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/5060-33-0x0000000000FB0000-0x0000000000FB3000-memory.dmp

Filesize
12KB

Download