blackmoon | 0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274

Analysis

max time kernel
187s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe
Size

65KB
MD5

cdf493d8ed3d40c7ffe4e8691a3cc7b4
SHA1

528bf300aec53b90781e92b77e7b8830fcd68f15
SHA256

0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274
SHA512

22ae82a8821de9d3192aefd9b921a88acddeb8f0c8e617af9a930627005dfbe4bb919ad908d9c778155ba14ee7f34fcc71531cae4e60120ec8c6cec5ef4150a4
SSDEEP

1536:GZ9LvxXwtQM2hhzGeckCrFm+EZc8P0xXZf:2zxXrZnckUEZ1P0xJ

Score

10^/10

blackmoon banker persistence trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5052-136-0x0000000000400000-0x000000000042D000-memory.dmp	family_blackmoon
behavioral2/memory/5000-138-0x0000000000560000-0x000000000058D000-memory.dmp	family_blackmoon

Executes dropped EXE 1 IoCs

Processes:

syotom.exe

pid process

5000 syotom.exe

pid	process
5000	syotom.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\syotom = "C:\\Windows\\syotom.exe"	0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe

Drops file in Windows directory 2 IoCs

Processes:

0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe

description	ioc	process
File created	C:\Windows\syotom.exe	0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe
File opened for modification	C:\Windows\syotom.exe	0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3820 5000 WerFault.exe syotom.exe

pid	pid_target	process	target process
3820	5000	WerFault.exe	syotom.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe

description	pid	process	target process
PID 5052 wrote to memory of 5000	5052	0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe	syotom.exe
PID 5052 wrote to memory of 5000	5052	0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe	syotom.exe
PID 5052 wrote to memory of 5000	5052	0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe	syotom.exe

C:\Users\Admin\AppData\Local\Temp\0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe
"C:\Users\Admin\AppData\Local\Temp\0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5052

C:\Windows\syotom.exe
C:\Windows\syotom.exe
2⤵
- Executes dropped EXE
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 560
3⤵
- Program crash
PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5000 -ip 5000
1⤵
PID:3472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\syotom.exe

Filesize
65KB

MD5
cdf493d8ed3d40c7ffe4e8691a3cc7b4

SHA1
528bf300aec53b90781e92b77e7b8830fcd68f15

SHA256
0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274

SHA512
22ae82a8821de9d3192aefd9b921a88acddeb8f0c8e617af9a930627005dfbe4bb919ad908d9c778155ba14ee7f34fcc71531cae4e60120ec8c6cec5ef4150a4

Download Submit
C:\Windows\syotom.exe

Filesize
65KB

MD5
cdf493d8ed3d40c7ffe4e8691a3cc7b4

SHA1
528bf300aec53b90781e92b77e7b8830fcd68f15

SHA256
0b1fda37b5e7bcf4e98d34fc053874cebdf4f0432823fbe07312793a63e84274

SHA512
22ae82a8821de9d3192aefd9b921a88acddeb8f0c8e617af9a930627005dfbe4bb919ad908d9c778155ba14ee7f34fcc71531cae4e60120ec8c6cec5ef4150a4

Download Submit
memory/5000-133-0x0000000000000000-mapping.dmp

Download
memory/5000-137-0x0000000000430000-0x0000000000443000-memory.dmp

Filesize
76KB

Download
memory/5000-138-0x0000000000560000-0x000000000058D000-memory.dmp

Filesize
180KB

Download
memory/5052-132-0x0000000000430000-0x0000000000443000-memory.dmp

Filesize
76KB

Download
memory/5052-136-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/5052-139-0x0000000000430000-0x0000000000443000-memory.dmp

Filesize
76KB

Download