blackmoon | c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83

General

Target

c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83.exe
Size

4.0MB
MD5

9058fa47d074205aac12d95fb79bd53b
SHA1

18415a9d6ebd25910e6be70e7d4ce5f9ec653120
SHA256

c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83
SHA512

2ab810d0ee3586230071e8f57216aa60002061420c46a0b4addf90dfe547d184cd80f1b00f17816b652db9463a28c90d8d0a14bd82b71f90769d92ce31b1d51c
SSDEEP

98304:FPUpwKFQhvFGd6toOUVuwXWxiTsFtJ3L1ifCGJ:FPwT2FGGAVLXAT3RifCGJ

Score

10^/10

blackmoon joker banker infostealer trojan

Malware Config

Extracted

Family

joker

C2

https://htuzi.oss-cn-shanghai.aliyuncs.com

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 5 IoCs

resource	yara_rule
behavioral1/memory/1672-55-0x0000000000400000-0x00000000010A1000-memory.dmp	family_blackmoon
behavioral1/memory/1672-56-0x0000000000400000-0x00000000010A1000-memory.dmp	family_blackmoon
behavioral1/memory/1672-57-0x0000000000400000-0x00000000010A1000-memory.dmp	family_blackmoon
behavioral1/memory/1672-58-0x0000000000400000-0x00000000010A1000-memory.dmp	family_blackmoon
behavioral1/memory/1672-80-0x0000000000400000-0x00000000010A1000-memory.dmp	family_blackmoon

joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1672 set thread context of 384	1672	c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83.exe	29

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1672	c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83.exe
384	Dism.exe
384	Dism.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1672	c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83.exe
1672	c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83.exe
1672	c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1672	c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83.exe
1672	c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83.exe
1672	c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1672	c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83.exe
1672	c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83.exe
384	Dism.exe
384	Dism.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 384	1672	c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83.exe	29
PID 1672 wrote to memory of 384	1672	c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83.exe	29
PID 1672 wrote to memory of 384	1672	c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83.exe	29
PID 1672 wrote to memory of 384	1672	c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83.exe	29
PID 1672 wrote to memory of 384	1672	c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83.exe	29
PID 1672 wrote to memory of 384	1672	c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83.exe	29
PID 1672 wrote to memory of 384	1672	c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83.exe	29
PID 1672 wrote to memory of 384	1672	c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83.exe	29
PID 1672 wrote to memory of 384	1672	c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83.exe	29
PID 1672 wrote to memory of 384	1672	c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83.exe	29

C:\Users\Admin\AppData\Local\Temp\c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83.exe
"C:\Users\Admin\AppData\Local\Temp\c15317f780b0f408415f2e0a9a7811737068964ebe96927fd58552727fe00b83.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\Dism.exe
  C:\Windows\SysWOW64\Dism.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\EasySkin.ini

Filesize
129B

MD5
78d89536fa344a82364f1dda81d78f3a

SHA1
e866b4f7713f3b6718c2b4b836937c8b35ff7c31

SHA256
32c064c7c56cae4ea4ee32cf8ee2f110f2f715ed064c28c1a5e5b4b384439fa5

SHA512
2a04d9ea26e8617c60f5af189f2fce74baf151bb414390aa617adf140bce277d492764dc7a34671d0a09c61edebbd0b9f8d3ce591a2d6d54f66495f53cce6d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\1672_update\7z.7z

Filesize
4.0MB

MD5
a49c160682e6667d0243c3818fccaaea

SHA1
82238557e989fc15caab6bf9a2ec37fb89c00896

SHA256
c0339141897dbcdd4766497d95f7d797145255613ade154c0731a4b45d34f08a

SHA512
45b463a6f3245d9c384ae7b6f2a63f76228784960a1aced1221e5d060f6a41dcbbc3efd4ca0e4d5997deabfda88a468c76faccad4e105da3d7ce650ddef5a939

Download Submit
C:\Users\Admin\AppData\Local\Temp\1672_update\data.ini

Filesize
164B

MD5
2023b841c1579e612cf826e8187dbe4d

SHA1
3134dc512f0f6707e4fe51f73b632df5ee417823

SHA256
2732e020f4f1e54cf02b897b70a36e78be7cd59aa8e6ed640476ba16bb6c9ac5

SHA512
3c98ff8c397e4677fa506b566a9a05b0ef3577f1b197bf430a41792235176109b57e1755823e497a359f982348aac7c267a03960fd9018ec4d293082859884b7

Download Submit
memory/384-75-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/384-71-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/384-59-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/384-60-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/384-62-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/384-65-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/384-68-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/1672-58-0x0000000000400000-0x00000000010A1000-memory.dmp

Filesize
12.6MB

Download
memory/1672-54-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download
memory/1672-76-0x000000001006C000-0x00000000100AC000-memory.dmp

Filesize
256KB

Download
memory/1672-57-0x0000000000400000-0x00000000010A1000-memory.dmp

Filesize
12.6MB

Download
memory/1672-56-0x0000000000400000-0x00000000010A1000-memory.dmp

Filesize
12.6MB

Download
memory/1672-55-0x0000000000400000-0x00000000010A1000-memory.dmp

Filesize
12.6MB

Download
memory/1672-80-0x0000000000400000-0x00000000010A1000-memory.dmp

Filesize
12.6MB

Download

Analysis

Sharing