blackmoon | e893c529965161d1b0311e932df85b848c8ad59ba099f4371a6b25204ef863ef

Analysis

max time kernel
122s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e893c529965161d1b0311e932df85b848c8ad59ba099f4371a6b25204ef863ef.exe
Size

177KB
MD5

0813291c82e78cbfce97ed2edd8ef6d0
SHA1

22e25ff99a9a13336c6f1954f88738450d5a1915
SHA256

e893c529965161d1b0311e932df85b848c8ad59ba099f4371a6b25204ef863ef
SHA512

6e9f909ca749c7792b3e50a9cf72f3cf8ef2ebbe789327e4f9a84ebd587e81f905c7bd35193f3909b1edceb8d4c97c6cf7e6ccbea5412f0b1f1c3acb396869b1
SSDEEP

3072:PDrcxYp9wMwF9JSuLdudWBBqJudmfT1dcqWZIqopGyZitKZ3sYJKtgLjOeQ:PDYxauMy9JrLdPBqYAhd7WZIq1yZiYsK

Score

10^/10

blackmoon banker persistence trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

resource	yara_rule
behavioral2/memory/4896-133-0x0000000000400000-0x0000000000454000-memory.dmp	family_blackmoon
behavioral2/memory/4896-134-0x0000000000400000-0x0000000000454000-memory.dmp	family_blackmoon

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	e893c529965161d1b0311e932df85b848c8ad59ba099f4371a6b25204ef863ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\syotom = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e893c529965161d1b0311e932df85b848c8ad59ba099f4371a6b25204ef863ef.exe"	e893c529965161d1b0311e932df85b848c8ad59ba099f4371a6b25204ef863ef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	e893c529965161d1b0311e932df85b848c8ad59ba099f4371a6b25204ef863ef.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "www.naver.com"	e893c529965161d1b0311e932df85b848c8ad59ba099f4371a6b25204ef863ef.exe

C:\Users\Admin\AppData\Local\Temp\e893c529965161d1b0311e932df85b848c8ad59ba099f4371a6b25204ef863ef.exe
"C:\Users\Admin\AppData\Local\Temp\e893c529965161d1b0311e932df85b848c8ad59ba099f4371a6b25204ef863ef.exe"
1⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:4896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4896-132-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4896-133-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4896-134-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads