blackmoon | aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce

General

Target

aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
Size

149KB
MD5

a9f4c4770dadf904813b42f8595a7984
SHA1

c86a0801ed9af0c7e8ab76642c5fe68797f46f90
SHA256

aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce
SHA512

b94537d771c05e5a06d1b3bd9b0242f7de3b66163584a6e1792beb8313ad72a1455ede7362ec02798a8f4cb1685e677d2f2f38d869520bf9b891e7b331d78199
SSDEEP

3072:xBriMhS9WyZo4mbqizu7rwGGBvN2VwdB/6SG:xBmxP/eq8ugGkvNWwdF6S

Score

10^/10

blackmoon banker persistence trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 10 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2032-54-0x0000000000400000-0x0000000000464000-memory.dmp	family_blackmoon
behavioral1/memory/2032-55-0x0000000000400000-0x0000000000464000-memory.dmp	family_blackmoon
behavioral1/memory/2032-56-0x0000000000400000-0x0000000000464000-memory.dmp	family_blackmoon
behavioral1/memory/2032-57-0x0000000000400000-0x0000000000464000-memory.dmp	family_blackmoon
behavioral1/memory/2032-61-0x00000000021F0000-0x000000000224D000-memory.dmp	family_blackmoon
behavioral1/memory/2032-62-0x00000000021F0000-0x000000000224D000-memory.dmp	family_blackmoon
behavioral1/memory/2032-79-0x00000000021F0000-0x000000000224D000-memory.dmp	family_blackmoon
behavioral1/memory/2032-88-0x00000000021F0000-0x000000000224D000-memory.dmp	family_blackmoon
behavioral1/memory/2032-91-0x00000000021F0000-0x000000000224D000-memory.dmp	family_blackmoon
behavioral1/memory/2032-93-0x0000000000400000-0x0000000000464000-memory.dmp	family_blackmoon

Loads dropped DLL 1 IoCs

Processes:

aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

pid process

2032 aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows\CurrentVersion\Run	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdate = "C:\\Users\\Public\\Documents\\Applicationagzlk.exe"	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

996 NOTEPAD.EXE

pid	process
996	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

pid	process
2032	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
2032	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
2032	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
2032	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
2032	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
2032	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
2032	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
2032	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

pid process

2032 aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

pid	process
2032	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
2032	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
2032	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

description	pid	process	target process
PID 2032 wrote to memory of 996	2032	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe	NOTEPAD.EXE
PID 2032 wrote to memory of 996	2032	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe	NOTEPAD.EXE
PID 2032 wrote to memory of 996	2032	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe	NOTEPAD.EXE
PID 2032 wrote to memory of 996	2032	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe	NOTEPAD.EXE

C:\Users\Admin\AppData\Local\Temp\aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
"C:\Users\Admin\AppData\Local\Temp\aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.txt
2⤵
- Opens file in notepad (likely ransom note)
PID:996

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.txt
Filesize
4KB

MD5
ac8543e0dfa29ed8ba894dd18d8d9e53

SHA1
4cd35b6b472923495c1ca55eb530983a0ea16e6c

SHA256
f6e3fd231cfa6b327d2c30c7beb374623c08dbac910dacd460e79ca0a2a51f01

SHA512
d36aa0753906a82eee68455b591f2380704d4879c196eacb2364a6f4a618e47e7361bb4eeacb71efdc1432491bdfb9fd9208894ecaf7f057abd39710e296d2a9

Download Submit
C:\Users\Public\Documents\sjsw.log
Filesize
214B

MD5
e7b236b0572a8544e64bf309faba133d

SHA1
03806431e14f2c74eed2d542880eda7150bb60be

SHA256
0c688a6496737a7932cffbf6018669d2927cc94a8d42c605c9266f12f8d6c68a

SHA512
42bff1f1df4e0f11fcfd0a50e7c80fab33707bc91337cf0dca4513871644b2d4a1d284f3aaa105cf43b1d275bc795fb8ddcbfbc0c3c22c221e3e7d3eac79177a

Download Submit
\Users\Public\Documents\sttr.dll
Filesize
2KB

MD5
7943effe67a4647e06def2348949020e

SHA1
eabd561f0639a975de259633f63896d82c3f878d

SHA256
3fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa

SHA512
c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003

Download Submit
memory/2032-79-0x00000000021F0000-0x000000000224D000-memory.dmp

Filesize
372KB

Download
memory/2032-81-0x00000000030A0000-0x0000000003220000-memory.dmp

Filesize
1.5MB

Download
memory/2032-61-0x00000000021F0000-0x000000000224D000-memory.dmp

Filesize
372KB

Download
memory/2032-62-0x00000000021F0000-0x000000000224D000-memory.dmp

Filesize
372KB

Download
memory/2032-56-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2032-55-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2032-54-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2032-80-0x00000000002E0000-0x00000000002E3000-memory.dmp

Filesize
12KB

Download
memory/2032-57-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2032-88-0x00000000021F0000-0x000000000224D000-memory.dmp

Filesize
372KB

Download
memory/2032-89-0x0000000004080000-0x000000000416C000-memory.dmp

Filesize
944KB

Download
memory/2032-91-0x00000000021F0000-0x000000000224D000-memory.dmp

Filesize
372KB

Download
memory/2032-93-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2032-94-0x0000000002E50000-0x0000000002F60000-memory.dmp

Filesize
1.1MB

Download
memory/2032-87-0x0000000004080000-0x000000000416C000-memory.dmp

Filesize
944KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads