blackmoon | 70c1395c202359a6d45426a2ba8d045dfbb9dcfbd0b294173e2403310be3f1fa

Analysis

max time kernel
358s
max time network
439s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70c1395c202359a6d45426a2ba8d045dfbb9dcfbd0b294173e2403310be3f1fa.exe
Size

10.8MB
MD5

1c974b9aaf3a98cd2221591db21f9f93
SHA1

19cc90e4969a97971d5a45bccd35bf5612644de7
SHA256

70c1395c202359a6d45426a2ba8d045dfbb9dcfbd0b294173e2403310be3f1fa
SHA512

54df741f40a3d641d6f9b711e614f14eb4b207d255d3b8ced850dcf90701cb16626cf1027f9a8bd5d3412e5edd3b8b83c644dc39afe579d57cabff78617a5f8a
SSDEEP

196608:lU6na3D1MLj1Zd//tYL/LQ1K+AHtIa8SL:lUbM5/aL/RHtpxL

Score

10^/10

blackmoon banker bootkit persistence trojan upx vmprotect

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4064-132-0x0000000000400000-0x0000000000F03000-memory.dmp	family_blackmoon

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4064-134-0x0000000002F80000-0x0000000002FA6000-memory.dmp	upx
behavioral2/memory/4064-136-0x0000000002F80000-0x0000000002FA6000-memory.dmp	upx
behavioral2/memory/4064-139-0x0000000002F80000-0x0000000002FA6000-memory.dmp	upx
behavioral2/memory/4064-140-0x0000000002F80000-0x0000000002FA6000-memory.dmp	upx

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral2/memory/4064-132-0x0000000000400000-0x0000000000F03000-memory.dmp	vmprotect

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

70c1395c202359a6d45426a2ba8d045dfbb9dcfbd0b294173e2403310be3f1fa.exe

description ioc process

File opened for modification \??\PhysicalDrive0 70c1395c202359a6d45426a2ba8d045dfbb9dcfbd0b294173e2403310be3f1fa.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	70c1395c202359a6d45426a2ba8d045dfbb9dcfbd0b294173e2403310be3f1fa.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

70c1395c202359a6d45426a2ba8d045dfbb9dcfbd0b294173e2403310be3f1fa.exe

pid	process
4064	70c1395c202359a6d45426a2ba8d045dfbb9dcfbd0b294173e2403310be3f1fa.exe
4064	70c1395c202359a6d45426a2ba8d045dfbb9dcfbd0b294173e2403310be3f1fa.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

70c1395c202359a6d45426a2ba8d045dfbb9dcfbd0b294173e2403310be3f1fa.exe

pid	process
4064	70c1395c202359a6d45426a2ba8d045dfbb9dcfbd0b294173e2403310be3f1fa.exe
4064	70c1395c202359a6d45426a2ba8d045dfbb9dcfbd0b294173e2403310be3f1fa.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

70c1395c202359a6d45426a2ba8d045dfbb9dcfbd0b294173e2403310be3f1fa.exe

description	pid	process	target process
PID 4064 wrote to memory of 4716	4064	70c1395c202359a6d45426a2ba8d045dfbb9dcfbd0b294173e2403310be3f1fa.exe	cmd.exe
PID 4064 wrote to memory of 4716	4064	70c1395c202359a6d45426a2ba8d045dfbb9dcfbd0b294173e2403310be3f1fa.exe	cmd.exe
PID 4064 wrote to memory of 4716	4064	70c1395c202359a6d45426a2ba8d045dfbb9dcfbd0b294173e2403310be3f1fa.exe	cmd.exe
PID 4064 wrote to memory of 2400	4064	70c1395c202359a6d45426a2ba8d045dfbb9dcfbd0b294173e2403310be3f1fa.exe	cmd.exe
PID 4064 wrote to memory of 2400	4064	70c1395c202359a6d45426a2ba8d045dfbb9dcfbd0b294173e2403310be3f1fa.exe	cmd.exe
PID 4064 wrote to memory of 2400	4064	70c1395c202359a6d45426a2ba8d045dfbb9dcfbd0b294173e2403310be3f1fa.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\70c1395c202359a6d45426a2ba8d045dfbb9dcfbd0b294173e2403310be3f1fa.exe
"C:\Users\Admin\AppData\Local\Temp\70c1395c202359a6d45426a2ba8d045dfbb9dcfbd0b294173e2403310be3f1fa.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4064

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C C:\Users\Admin\AppData\Local\Temp\rom8E6C.tmp.exe > C:\Users\Admin\AppData\Local\Temp\rom8E6C.tmp
2⤵
PID:4716

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C C:\Users\Admin\AppData\Local\Temp\romAED6.tmp.exe > C:\Users\Admin\AppData\Local\Temp\romAED6.tmp
2⤵
PID:2400

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2400-138-0x0000000000000000-mapping.dmp

Download
memory/4064-132-0x0000000000400000-0x0000000000F03000-memory.dmp

Filesize
11.0MB

Download
memory/4064-134-0x0000000002F80000-0x0000000002FA6000-memory.dmp

Filesize
152KB

Download
memory/4064-136-0x0000000002F80000-0x0000000002FA6000-memory.dmp

Filesize
152KB

Download
memory/4064-139-0x0000000002F80000-0x0000000002FA6000-memory.dmp

Filesize
152KB

Download
memory/4064-140-0x0000000002F80000-0x0000000002FA6000-memory.dmp

Filesize
152KB

Download
memory/4716-135-0x0000000000000000-mapping.dmp

Download