blackmoon | 0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274

Analysis

max time kernel
38s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe
Size

65KB
MD5

cdf493d8ed3d40c7ffe4e8691a3cc7b4
SHA1

528bf300aec53b90781e92b77e7b8830fcd68f15
SHA256

0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274
SHA512

22ae82a8821de9d3192aefd9b921a88acddeb8f0c8e617af9a930627005dfbe4bb919ad908d9c778155ba14ee7f34fcc71531cae4e60120ec8c6cec5ef4150a4
SSDEEP

1536:GZ9LvxXwtQM2hhzGeckCrFm+EZc8P0xXZf:2zxXrZnckUEZ1P0xJ

Score

10^/10

blackmoon banker persistence trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1508-59-0x0000000000400000-0x000000000042D000-memory.dmp	family_blackmoon
behavioral1/memory/1400-62-0x0000000000400000-0x000000000042D000-memory.dmp	family_blackmoon
behavioral1/memory/1400-64-0x0000000000400000-0x000000000042D000-memory.dmp	family_blackmoon

Executes dropped EXE 1 IoCs

Processes:

syotom.exe

pid process

1400 syotom.exe

pid	process
1400	syotom.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\syotom = "C:\\Windows\\syotom.exe"	0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe

Drops file in Windows directory 2 IoCs

Processes:

0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe

description	ioc	process
File created	C:\Windows\syotom.exe	0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe
File opened for modification	C:\Windows\syotom.exe	0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe

description	pid	process	target process
PID 1508 wrote to memory of 1400	1508	0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe	syotom.exe
PID 1508 wrote to memory of 1400	1508	0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe	syotom.exe
PID 1508 wrote to memory of 1400	1508	0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe	syotom.exe
PID 1508 wrote to memory of 1400	1508	0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe	syotom.exe

C:\Users\Admin\AppData\Local\Temp\0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe
"C:\Users\Admin\AppData\Local\Temp\0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\syotom.exe
C:\Windows\syotom.exe
2⤵
- Executes dropped EXE
PID:1400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\syotom.exe

Filesize
65KB

MD5
cdf493d8ed3d40c7ffe4e8691a3cc7b4

SHA1
528bf300aec53b90781e92b77e7b8830fcd68f15

SHA256
0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274

SHA512
22ae82a8821de9d3192aefd9b921a88acddeb8f0c8e617af9a930627005dfbe4bb919ad908d9c778155ba14ee7f34fcc71531cae4e60120ec8c6cec5ef4150a4

Download Submit
C:\Windows\syotom.exe

Filesize
65KB

MD5
cdf493d8ed3d40c7ffe4e8691a3cc7b4

SHA1
528bf300aec53b90781e92b77e7b8830fcd68f15

SHA256
0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274

SHA512
22ae82a8821de9d3192aefd9b921a88acddeb8f0c8e617af9a930627005dfbe4bb919ad908d9c778155ba14ee7f34fcc71531cae4e60120ec8c6cec5ef4150a4

Download Submit
memory/1400-55-0x0000000000000000-mapping.dmp

Download
memory/1400-62-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1400-64-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1508-54-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/1508-58-0x0000000000430000-0x0000000000443000-memory.dmp

Filesize
76KB

Download
memory/1508-59-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1508-60-0x00000000002C0000-0x00000000002D3000-memory.dmp

Filesize
76KB

Download
memory/1508-61-0x00000000002C0000-0x00000000002D3000-memory.dmp

Filesize
76KB

Download