blackmoon | 0927e4d14df517b0488aac0631fbbeeea13fa5d8a6ec00bc4749c6669dc966fa

General

Target

0927e4d14df517b0488aac0631fbbeeea13fa5d8a6ec00bc4749c6669dc966fa.exe
Size

82KB
MD5

3c86ad63c6884aacde7f7c574a9a5593
SHA1

9f9793fe31566dd24750efe8fc8a6a0c43f023af
SHA256

0927e4d14df517b0488aac0631fbbeeea13fa5d8a6ec00bc4749c6669dc966fa
SHA512

aee9dc5bf4dfef41cb5c868e48dc8cc344c3604edf097fdeb6a5a6109b229831dc970e72b0af452b2d270e2c21bf54913079076a6ff19381623450068f9ec95b
SSDEEP

1536:/sVyZh7S+jOvKCuv+5eKQ2vES36M7o5jUabtHnIwGsdbMK:/d2KC++5eKQ2vEK37oV3toHa

Score

10^/10

blackmoon banker trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/944-55-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackmoon
behavioral1/memory/944-56-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackmoon
behavioral1/memory/1964-62-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackmoon
behavioral1/memory/944-63-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackmoon
behavioral1/memory/1964-66-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackmoon

Executes dropped EXE 1 IoCs

Processes:

elxplorerbhmui.exe

pid process

1964 elxplorerbhmui.exe

pid	process
1964	elxplorerbhmui.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/944-55-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/944-56-0x0000000000400000-0x0000000000471000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\elxplorerbhmui.exe	upx
\Users\Admin\AppData\Local\Temp\elxplorerbhmui.exe	upx
C:\Users\Admin\AppData\Local\Temp\elxplorerbhmui.exe	upx
behavioral1/memory/1964-62-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/944-63-0x0000000000400000-0x0000000000471000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\elxplorerbhmui.exe	upx
behavioral1/memory/1964-66-0x0000000000400000-0x0000000000471000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

0927e4d14df517b0488aac0631fbbeeea13fa5d8a6ec00bc4749c6669dc966fa.exe

pid	process
944	0927e4d14df517b0488aac0631fbbeeea13fa5d8a6ec00bc4749c6669dc966fa.exe
944	0927e4d14df517b0488aac0631fbbeeea13fa5d8a6ec00bc4749c6669dc966fa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

0927e4d14df517b0488aac0631fbbeeea13fa5d8a6ec00bc4749c6669dc966fa.exeelxplorerbhmui.exe

pid	process
944	0927e4d14df517b0488aac0631fbbeeea13fa5d8a6ec00bc4749c6669dc966fa.exe
944	0927e4d14df517b0488aac0631fbbeeea13fa5d8a6ec00bc4749c6669dc966fa.exe
944	0927e4d14df517b0488aac0631fbbeeea13fa5d8a6ec00bc4749c6669dc966fa.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe
1964	elxplorerbhmui.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0927e4d14df517b0488aac0631fbbeeea13fa5d8a6ec00bc4749c6669dc966fa.exe

description	pid	process	target process
PID 944 wrote to memory of 1964	944	0927e4d14df517b0488aac0631fbbeeea13fa5d8a6ec00bc4749c6669dc966fa.exe	elxplorerbhmui.exe
PID 944 wrote to memory of 1964	944	0927e4d14df517b0488aac0631fbbeeea13fa5d8a6ec00bc4749c6669dc966fa.exe	elxplorerbhmui.exe
PID 944 wrote to memory of 1964	944	0927e4d14df517b0488aac0631fbbeeea13fa5d8a6ec00bc4749c6669dc966fa.exe	elxplorerbhmui.exe
PID 944 wrote to memory of 1964	944	0927e4d14df517b0488aac0631fbbeeea13fa5d8a6ec00bc4749c6669dc966fa.exe	elxplorerbhmui.exe

C:\Users\Admin\AppData\Local\Temp\0927e4d14df517b0488aac0631fbbeeea13fa5d8a6ec00bc4749c6669dc966fa.exe
"C:\Users\Admin\AppData\Local\Temp\0927e4d14df517b0488aac0631fbbeeea13fa5d8a6ec00bc4749c6669dc966fa.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:944

C:\Users\Admin\AppData\Local\Temp\elxplorerbhmui.exe
"C:\Users\Admin\AppData\Local\Temp\elxplorerbhmui.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\elxplorerbhmui.exe
Filesize
82KB

MD5
42c16b514ef73745f9fca9f84289f6b9

SHA1
8ef055eb653ec775125f4ac94c7fcca0a1433a01

SHA256
899ca3c945498b2981fcb44fd113b1e6a5498fd843e54a422cbe11c19ffdc197

SHA512
835347bd674358658b462e91836a878600330b3c4b81cd530643f03d06e24c2886928f589817a219666c2c513299db7a48bbe814285a6868e23eca96b5e81c1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\elxplorerbhmui.exe
Filesize
82KB

MD5
42c16b514ef73745f9fca9f84289f6b9

SHA1
8ef055eb653ec775125f4ac94c7fcca0a1433a01

SHA256
899ca3c945498b2981fcb44fd113b1e6a5498fd843e54a422cbe11c19ffdc197

SHA512
835347bd674358658b462e91836a878600330b3c4b81cd530643f03d06e24c2886928f589817a219666c2c513299db7a48bbe814285a6868e23eca96b5e81c1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpath.ini
Filesize
102B

MD5
7dfe9d8c9eaf32e43b7704b6a41b0be9

SHA1
1b267b7393cfffa419b4aa73e897d23b23c3f941

SHA256
6c643606f63abfb0bd68d2dcd154384bcff84c7fa2e4193c6908c0244ab19972

SHA512
1c50fed4f8b7b608b8fd2f594c7f0022b4166723b419baffb5bcd47042cc9b3c3036202ab0e9e8ae755158921179b11407f48a9105683372538f58a2af9ab169

Download Submit
\Users\Admin\AppData\Local\Temp\elxplorerbhmui.exe
Filesize
82KB

MD5
42c16b514ef73745f9fca9f84289f6b9

SHA1
8ef055eb653ec775125f4ac94c7fcca0a1433a01

SHA256
899ca3c945498b2981fcb44fd113b1e6a5498fd843e54a422cbe11c19ffdc197

SHA512
835347bd674358658b462e91836a878600330b3c4b81cd530643f03d06e24c2886928f589817a219666c2c513299db7a48bbe814285a6868e23eca96b5e81c1b

Download Submit
\Users\Admin\AppData\Local\Temp\elxplorerbhmui.exe
Filesize
82KB

MD5
42c16b514ef73745f9fca9f84289f6b9

SHA1
8ef055eb653ec775125f4ac94c7fcca0a1433a01

SHA256
899ca3c945498b2981fcb44fd113b1e6a5498fd843e54a422cbe11c19ffdc197

SHA512
835347bd674358658b462e91836a878600330b3c4b81cd530643f03d06e24c2886928f589817a219666c2c513299db7a48bbe814285a6868e23eca96b5e81c1b

Download Submit
memory/944-54-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/944-55-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/944-56-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/944-63-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1964-59-0x0000000000000000-mapping.dmp

Download
memory/1964-62-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1964-66-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads