blackmoon | 1ebbd7ee49cd09ffb8c352b2863fa5324b5369d0836303e0a5a1390580e2c996

Analysis

max time kernel
20s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ebbd7ee49cd09ffb8c352b2863fa5324b5369d0836303e0a5a1390580e2c996.exe
Size

62KB
MD5

8df904b9e96ae8c9275aa19ce09bbf8a
SHA1

be1ebdc42147c3015569e6a5396c8918219e05d8
SHA256

1ebbd7ee49cd09ffb8c352b2863fa5324b5369d0836303e0a5a1390580e2c996
SHA512

ac2e152ee2fdc62479f685dd6124163a78081bc9be78586c1d5bab73187203d3a20daaee7ba8fe6a49372c9ca7c2fd23550e2198accdb9d47d2462d32faa3365
SSDEEP

1536:DM84HouVCAa/5akUnYdE6gqvCGy7R9r9W/71/39:DMtIuVCL4GlgqvCH99r9y7h3

Score

10^/10

blackmoon banker persistence trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1788-59-0x0000000000400000-0x0000000000436000-memory.dmp	family_blackmoon
behavioral1/memory/1668-60-0x0000000000400000-0x0000000000436000-memory.dmp	family_blackmoon

Executes dropped EXE 1 IoCs

Processes:

syotom.exe

pid process

1668 syotom.exe

pid	process
1668	syotom.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1ebbd7ee49cd09ffb8c352b2863fa5324b5369d0836303e0a5a1390580e2c996.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\syotom = "C:\\Windows\\syotom.exe"	1ebbd7ee49cd09ffb8c352b2863fa5324b5369d0836303e0a5a1390580e2c996.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	1ebbd7ee49cd09ffb8c352b2863fa5324b5369d0836303e0a5a1390580e2c996.exe

Drops file in Windows directory 2 IoCs

Processes:

1ebbd7ee49cd09ffb8c352b2863fa5324b5369d0836303e0a5a1390580e2c996.exe

description	ioc	process
File opened for modification	C:\Windows\syotom.exe	1ebbd7ee49cd09ffb8c352b2863fa5324b5369d0836303e0a5a1390580e2c996.exe
File created	C:\Windows\syotom.exe	1ebbd7ee49cd09ffb8c352b2863fa5324b5369d0836303e0a5a1390580e2c996.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1ebbd7ee49cd09ffb8c352b2863fa5324b5369d0836303e0a5a1390580e2c996.exe

description	pid	process	target process
PID 1788 wrote to memory of 1668	1788	1ebbd7ee49cd09ffb8c352b2863fa5324b5369d0836303e0a5a1390580e2c996.exe	syotom.exe
PID 1788 wrote to memory of 1668	1788	1ebbd7ee49cd09ffb8c352b2863fa5324b5369d0836303e0a5a1390580e2c996.exe	syotom.exe
PID 1788 wrote to memory of 1668	1788	1ebbd7ee49cd09ffb8c352b2863fa5324b5369d0836303e0a5a1390580e2c996.exe	syotom.exe
PID 1788 wrote to memory of 1668	1788	1ebbd7ee49cd09ffb8c352b2863fa5324b5369d0836303e0a5a1390580e2c996.exe	syotom.exe

C:\Users\Admin\AppData\Local\Temp\1ebbd7ee49cd09ffb8c352b2863fa5324b5369d0836303e0a5a1390580e2c996.exe
"C:\Users\Admin\AppData\Local\Temp\1ebbd7ee49cd09ffb8c352b2863fa5324b5369d0836303e0a5a1390580e2c996.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\syotom.exe
C:\Windows\syotom.exe
2⤵
- Executes dropped EXE
PID:1668

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\syotom.exe
Filesize
62KB

MD5
8df904b9e96ae8c9275aa19ce09bbf8a

SHA1
be1ebdc42147c3015569e6a5396c8918219e05d8

SHA256
1ebbd7ee49cd09ffb8c352b2863fa5324b5369d0836303e0a5a1390580e2c996

SHA512
ac2e152ee2fdc62479f685dd6124163a78081bc9be78586c1d5bab73187203d3a20daaee7ba8fe6a49372c9ca7c2fd23550e2198accdb9d47d2462d32faa3365

Download Submit
C:\Windows\syotom.exe
Filesize
62KB

MD5
8df904b9e96ae8c9275aa19ce09bbf8a

SHA1
be1ebdc42147c3015569e6a5396c8918219e05d8

SHA256
1ebbd7ee49cd09ffb8c352b2863fa5324b5369d0836303e0a5a1390580e2c996

SHA512
ac2e152ee2fdc62479f685dd6124163a78081bc9be78586c1d5bab73187203d3a20daaee7ba8fe6a49372c9ca7c2fd23550e2198accdb9d47d2462d32faa3365

Download Submit
memory/1668-55-0x0000000000000000-mapping.dmp

Download
memory/1668-60-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1788-54-0x0000000076711000-0x0000000076713000-memory.dmp

Filesize
8KB

Download
memory/1788-59-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads