blackmoon | 93c4ed64dc4c94a5ee75d3b71bcd05779e6144ad3e16801d0c7dd6edcf33727f

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 05:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93c4ed64dc4c94a5ee75d3b71bcd05779e6144ad3e16801d0c7dd6edcf33727f.exe
Size

129KB
MD5

32ceef1cc2a15e91db6645b0e1c94b54
SHA1

cf76717ac222d121d8ff7843627b1e31a21b8240
SHA256

93c4ed64dc4c94a5ee75d3b71bcd05779e6144ad3e16801d0c7dd6edcf33727f
SHA512

9385e85035d75519158123b8463c8f33599eef64bda32b526a5cd7ecd7b50a5bfaa1ccaba416ae1db08af344de64a98cc041a5dba9f724359c6336c23e3cfe2f
SSDEEP

3072:Z+WNkNXcl6hRICWl3BmFGTd2ko7o1jzzX5mTout:Z+WNOnh6CWl3VMbS3T8ToS

Score

10^/10

blackmoon banker persistence trojan vmprotect

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1992-60-0x0000000000400000-0x000000000043E000-memory.dmp	family_blackmoon

Drops file in Drivers directory 1 IoCs

Processes:

93c4ed64dc4c94a5ee75d3b71bcd05779e6144ad3e16801d0c7dd6edcf33727f.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	93c4ed64dc4c94a5ee75d3b71bcd05779e6144ad3e16801d0c7dd6edcf33727f.exe

Executes dropped EXE 1 IoCs

Processes:

DETCAXZ.exe

pid process

1400 DETCAXZ.exe
Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

VMProtect packed file 7 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
\Windows\SysWOW64\HIMYM.DLL	vmprotect
C:\Windows\SysWOW64\HIMYM.DLL	vmprotect
\Windows\SysWOW64\HIMYM.DLL	vmprotect
\Windows\SysWOW64\HIMYM.DLL	vmprotect
\Windows\SysWOW64\HIMYM.DLL	vmprotect
\Windows\SysWOW64\HIMYM.DLL	vmprotect
\Windows\SysWOW64\HIMYM.DLL	vmprotect

Loads dropped DLL 8 IoCs

Processes:

93c4ed64dc4c94a5ee75d3b71bcd05779e6144ad3e16801d0c7dd6edcf33727f.exerundll32.execmd.execmd.exe

pid	process
1992	93c4ed64dc4c94a5ee75d3b71bcd05779e6144ad3e16801d0c7dd6edcf33727f.exe
1992	93c4ed64dc4c94a5ee75d3b71bcd05779e6144ad3e16801d0c7dd6edcf33727f.exe
1340	rundll32.exe
1340	rundll32.exe
1340	rundll32.exe
1340	rundll32.exe
1552	cmd.exe
1288	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Disker = "rundll32.exe C:\\Windows\\system32\\HIMYM.DLL,DW"	rundll32.exe

Drops file in System32 directory 1 IoCs

Processes:

DETCAXZ.exe

description ioc process

File created C:\Windows\SysWOW64\HIMYM.DLL DETCAXZ.exe

description	ioc	process
File created	C:\Windows\SysWOW64\HIMYM.DLL	DETCAXZ.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

DETCAXZ.exe93c4ed64dc4c94a5ee75d3b71bcd05779e6144ad3e16801d0c7dd6edcf33727f.exe

pid	process
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1992	93c4ed64dc4c94a5ee75d3b71bcd05779e6144ad3e16801d0c7dd6edcf33727f.exe
1992	93c4ed64dc4c94a5ee75d3b71bcd05779e6144ad3e16801d0c7dd6edcf33727f.exe
1992	93c4ed64dc4c94a5ee75d3b71bcd05779e6144ad3e16801d0c7dd6edcf33727f.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe
1400	DETCAXZ.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

DETCAXZ.exe

description	pid	process
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe
Token: SeDebugPrivilege	1400	DETCAXZ.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

93c4ed64dc4c94a5ee75d3b71bcd05779e6144ad3e16801d0c7dd6edcf33727f.exeDETCAXZ.exe

description	pid	process	target process
PID 1992 wrote to memory of 1400	1992	93c4ed64dc4c94a5ee75d3b71bcd05779e6144ad3e16801d0c7dd6edcf33727f.exe	DETCAXZ.exe
PID 1992 wrote to memory of 1400	1992	93c4ed64dc4c94a5ee75d3b71bcd05779e6144ad3e16801d0c7dd6edcf33727f.exe	DETCAXZ.exe
PID 1992 wrote to memory of 1400	1992	93c4ed64dc4c94a5ee75d3b71bcd05779e6144ad3e16801d0c7dd6edcf33727f.exe	DETCAXZ.exe
PID 1992 wrote to memory of 1400	1992	93c4ed64dc4c94a5ee75d3b71bcd05779e6144ad3e16801d0c7dd6edcf33727f.exe	DETCAXZ.exe
PID 1400 wrote to memory of 1340	1400	DETCAXZ.exe	rundll32.exe
PID 1400 wrote to memory of 1340	1400	DETCAXZ.exe	rundll32.exe
PID 1400 wrote to memory of 1340	1400	DETCAXZ.exe	rundll32.exe
PID 1400 wrote to memory of 1340	1400	DETCAXZ.exe	rundll32.exe
PID 1400 wrote to memory of 1340	1400	DETCAXZ.exe	rundll32.exe
PID 1400 wrote to memory of 1340	1400	DETCAXZ.exe	rundll32.exe
PID 1400 wrote to memory of 1340	1400	DETCAXZ.exe	rundll32.exe
PID 1400 wrote to memory of 1552	1400	DETCAXZ.exe	cmd.exe
PID 1400 wrote to memory of 1552	1400	DETCAXZ.exe	cmd.exe
PID 1400 wrote to memory of 1552	1400	DETCAXZ.exe	cmd.exe
PID 1400 wrote to memory of 1552	1400	DETCAXZ.exe	cmd.exe
PID 1992 wrote to memory of 1288	1992	93c4ed64dc4c94a5ee75d3b71bcd05779e6144ad3e16801d0c7dd6edcf33727f.exe	cmd.exe
PID 1992 wrote to memory of 1288	1992	93c4ed64dc4c94a5ee75d3b71bcd05779e6144ad3e16801d0c7dd6edcf33727f.exe	cmd.exe
PID 1992 wrote to memory of 1288	1992	93c4ed64dc4c94a5ee75d3b71bcd05779e6144ad3e16801d0c7dd6edcf33727f.exe	cmd.exe
PID 1992 wrote to memory of 1288	1992	93c4ed64dc4c94a5ee75d3b71bcd05779e6144ad3e16801d0c7dd6edcf33727f.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\93c4ed64dc4c94a5ee75d3b71bcd05779e6144ad3e16801d0c7dd6edcf33727f.exe
"C:\Users\Admin\AppData\Local\Temp\93c4ed64dc4c94a5ee75d3b71bcd05779e6144ad3e16801d0c7dd6edcf33727f.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1992

C:\Users\Admin\AppData\Local\Temp\DETCAXZ.exe
C:\Users\Admin\AppData\Local\Temp\DETCAXZ.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1400

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Windows\system32\HIMYM.DLL,DW
3⤵
- Loads dropped DLL
- Adds Run key to start application
PID:1340

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\DETCAXZ.exe"
3⤵
- Loads dropped DLL
PID:1552

C:\Windows\SysWOW64\cmd.exe
cmd /c del "C:\Users\Admin\AppData\Local\Temp\93c4ed64dc4c94a5ee75d3b71bcd05779e6144ad3e16801d0c7dd6edcf33727f.exe"
2⤵
- Loads dropped DLL
PID:1288

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DETCAXZ.exe
Filesize
80.1MB

MD5
16bf5055b4b0e5db136da3e6940b3a48

SHA1
b372531b266cc93fe38c596ccda872e2add67f93

SHA256
1ec8e6565c13745d2073bcacdea5d53082b053bca8a47abf965e5922bdfdce17

SHA512
e30ad97a83ca2dbc6ebdf36fb7694f3bca87db186a1eae7bd9069a85447d38fa9cae493e51bf80f558f2b3102f23d83ebf6ea87a6a230fce939d59b70c2266da

Download Submit
C:\Windows\SysWOW64\HIMYM.DLL
Filesize
100KB

MD5
c9b14c8e3af048a7ef6546f2981dc16f

SHA1
f146e301b8ef68159cc3d45f529f9c68e4941b4e

SHA256
fc3850ce2af7a4d437f4030009d440a3f2f394c7ee2f8c5a7e12a1a7b0d79a48

SHA512
9de8f0ff94a9b7ee204b4b8cae01c11518e52d18dc2f2d6ce94232f4d052bd28c59143675c189ef25c7bcbb622232bbec72a3286250c08dce927c710f9beaa45

Download Submit
\Users\Admin\AppData\Local\Temp\DETCAXZ.exe
Filesize
80.1MB

MD5
16bf5055b4b0e5db136da3e6940b3a48

SHA1
b372531b266cc93fe38c596ccda872e2add67f93

SHA256
1ec8e6565c13745d2073bcacdea5d53082b053bca8a47abf965e5922bdfdce17

SHA512
e30ad97a83ca2dbc6ebdf36fb7694f3bca87db186a1eae7bd9069a85447d38fa9cae493e51bf80f558f2b3102f23d83ebf6ea87a6a230fce939d59b70c2266da

Download Submit
\Users\Admin\AppData\Local\Temp\DETCAXZ.exe
Filesize
80.1MB

MD5
16bf5055b4b0e5db136da3e6940b3a48

SHA1
b372531b266cc93fe38c596ccda872e2add67f93

SHA256
1ec8e6565c13745d2073bcacdea5d53082b053bca8a47abf965e5922bdfdce17

SHA512
e30ad97a83ca2dbc6ebdf36fb7694f3bca87db186a1eae7bd9069a85447d38fa9cae493e51bf80f558f2b3102f23d83ebf6ea87a6a230fce939d59b70c2266da

Download Submit
\Windows\SysWOW64\HIMYM.DLL
Filesize
100KB

MD5
c9b14c8e3af048a7ef6546f2981dc16f

SHA1
f146e301b8ef68159cc3d45f529f9c68e4941b4e

SHA256
fc3850ce2af7a4d437f4030009d440a3f2f394c7ee2f8c5a7e12a1a7b0d79a48

SHA512
9de8f0ff94a9b7ee204b4b8cae01c11518e52d18dc2f2d6ce94232f4d052bd28c59143675c189ef25c7bcbb622232bbec72a3286250c08dce927c710f9beaa45

Download Submit
\Windows\SysWOW64\HIMYM.DLL
Filesize
100KB

MD5
c9b14c8e3af048a7ef6546f2981dc16f

SHA1
f146e301b8ef68159cc3d45f529f9c68e4941b4e

SHA256
fc3850ce2af7a4d437f4030009d440a3f2f394c7ee2f8c5a7e12a1a7b0d79a48

SHA512
9de8f0ff94a9b7ee204b4b8cae01c11518e52d18dc2f2d6ce94232f4d052bd28c59143675c189ef25c7bcbb622232bbec72a3286250c08dce927c710f9beaa45

Download Submit
\Windows\SysWOW64\HIMYM.DLL
Filesize
100KB

MD5
c9b14c8e3af048a7ef6546f2981dc16f

SHA1
f146e301b8ef68159cc3d45f529f9c68e4941b4e

SHA256
fc3850ce2af7a4d437f4030009d440a3f2f394c7ee2f8c5a7e12a1a7b0d79a48

SHA512
9de8f0ff94a9b7ee204b4b8cae01c11518e52d18dc2f2d6ce94232f4d052bd28c59143675c189ef25c7bcbb622232bbec72a3286250c08dce927c710f9beaa45

Download Submit
\Windows\SysWOW64\HIMYM.DLL
Filesize
100KB

MD5
c9b14c8e3af048a7ef6546f2981dc16f

SHA1
f146e301b8ef68159cc3d45f529f9c68e4941b4e

SHA256
fc3850ce2af7a4d437f4030009d440a3f2f394c7ee2f8c5a7e12a1a7b0d79a48

SHA512
9de8f0ff94a9b7ee204b4b8cae01c11518e52d18dc2f2d6ce94232f4d052bd28c59143675c189ef25c7bcbb622232bbec72a3286250c08dce927c710f9beaa45

Download Submit
\Windows\SysWOW64\HIMYM.DLL
Filesize
100KB

MD5
c9b14c8e3af048a7ef6546f2981dc16f

SHA1
f146e301b8ef68159cc3d45f529f9c68e4941b4e

SHA256
fc3850ce2af7a4d437f4030009d440a3f2f394c7ee2f8c5a7e12a1a7b0d79a48

SHA512
9de8f0ff94a9b7ee204b4b8cae01c11518e52d18dc2f2d6ce94232f4d052bd28c59143675c189ef25c7bcbb622232bbec72a3286250c08dce927c710f9beaa45

Download Submit
\Windows\SysWOW64\HIMYM.DLL
Filesize
100KB

MD5
c9b14c8e3af048a7ef6546f2981dc16f

SHA1
f146e301b8ef68159cc3d45f529f9c68e4941b4e

SHA256
fc3850ce2af7a4d437f4030009d440a3f2f394c7ee2f8c5a7e12a1a7b0d79a48

SHA512
9de8f0ff94a9b7ee204b4b8cae01c11518e52d18dc2f2d6ce94232f4d052bd28c59143675c189ef25c7bcbb622232bbec72a3286250c08dce927c710f9beaa45

Download Submit
memory/1288-76-0x0000000000000000-mapping.dmp

Download
memory/1340-66-0x0000000000000000-mapping.dmp

Download
memory/1400-65-0x00000000001C0000-0x00000000001F6000-memory.dmp

Filesize
216KB

Download
memory/1400-64-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1400-63-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1400-62-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1400-74-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1400-57-0x0000000000000000-mapping.dmp

Download
memory/1552-68-0x0000000000000000-mapping.dmp

Download
memory/1992-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1992-61-0x000000000BFD0000-0x000000000CFD0000-memory.dmp

Filesize
16.0MB

Download
memory/1992-60-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads