blackmoon | aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce

General

Target

aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
Size

149KB
MD5

a9f4c4770dadf904813b42f8595a7984
SHA1

c86a0801ed9af0c7e8ab76642c5fe68797f46f90
SHA256

aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce
SHA512

b94537d771c05e5a06d1b3bd9b0242f7de3b66163584a6e1792beb8313ad72a1455ede7362ec02798a8f4cb1685e677d2f2f38d869520bf9b891e7b331d78199
SSDEEP

3072:xBriMhS9WyZo4mbqizu7rwGGBvN2VwdB/6SG:xBmxP/eq8ugGkvNWwdF6S

Score

10^/10

blackmoon banker persistence trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 10 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3048-133-0x0000000000400000-0x0000000000464000-memory.dmp	family_blackmoon
behavioral2/memory/3048-134-0x0000000000400000-0x0000000000464000-memory.dmp	family_blackmoon
behavioral2/memory/3048-135-0x0000000000400000-0x0000000000464000-memory.dmp	family_blackmoon
behavioral2/memory/3048-136-0x0000000000400000-0x0000000000464000-memory.dmp	family_blackmoon
behavioral2/memory/3048-141-0x0000000002CF0000-0x0000000002D4D000-memory.dmp	family_blackmoon
behavioral2/memory/3048-142-0x0000000002CF0000-0x0000000002D4D000-memory.dmp	family_blackmoon
behavioral2/memory/3048-144-0x0000000002CF0000-0x0000000002D4D000-memory.dmp	family_blackmoon
behavioral2/memory/3048-169-0x0000000002CF0000-0x0000000002D4D000-memory.dmp	family_blackmoon
behavioral2/memory/3048-174-0x0000000000400000-0x0000000000464000-memory.dmp	family_blackmoon
behavioral2/memory/3048-171-0x0000000002CF0000-0x0000000002D4D000-memory.dmp	family_blackmoon

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

Loads dropped DLL 1 IoCs

Processes:

aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

pid process

3048 aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows\CurrentVersion\Run	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qdate = "C:\\Users\\Public\\Documents\\Applicationacsix.exe"	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

4976 NOTEPAD.EXE

pid	process
4976	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

pid	process
3048	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
3048	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
3048	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
3048	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
3048	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
3048	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
3048	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
3048	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
3048	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
3048	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
3048	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
3048	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
3048	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
3048	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
3048	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
3048	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

pid process

3048 aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

pid	process
3048	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
3048	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
3048	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe

description	pid	process	target process
PID 3048 wrote to memory of 4976	3048	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe	NOTEPAD.EXE
PID 3048 wrote to memory of 4976	3048	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe	NOTEPAD.EXE
PID 3048 wrote to memory of 4976	3048	aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe	NOTEPAD.EXE

C:\Users\Admin\AppData\Local\Temp\aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe
"C:\Users\Admin\AppData\Local\Temp\aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.txt
2⤵
- Opens file in notepad (likely ransom note)
PID:4976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aa5ec3fea3386647d47806e5a4137230a5ea30c6a936d640987d4c73e36652ce.txt
Filesize
4KB

MD5
ac8543e0dfa29ed8ba894dd18d8d9e53

SHA1
4cd35b6b472923495c1ca55eb530983a0ea16e6c

SHA256
f6e3fd231cfa6b327d2c30c7beb374623c08dbac910dacd460e79ca0a2a51f01

SHA512
d36aa0753906a82eee68455b591f2380704d4879c196eacb2364a6f4a618e47e7361bb4eeacb71efdc1432491bdfb9fd9208894ecaf7f057abd39710e296d2a9

Download Submit
C:\Users\Public\Documents\sjsw.log
Filesize
221B

MD5
2399ade93e501a0cbba1fc7872f7b2ef

SHA1
a217fa0f41dc8bb8ba4b1d81f5f1a8498c1f14a2

SHA256
999ccce0755acee9d9051aedbf924d26c3362fb7bb37b5ba481f56f552cd51a2

SHA512
17ea3051bbba9cfba60504f6ae730a45b8cc4774aaa090e8c71442fcea867bb09ec2577aac407055bd8a8bd2ce4336096a9b7dfe6258c9f01f9fed52ac0d66f4

Download Submit
C:\Users\Public\Documents\sttr.dll
Filesize
2KB

MD5
7943effe67a4647e06def2348949020e

SHA1
eabd561f0639a975de259633f63896d82c3f878d

SHA256
3fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa

SHA512
c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003

Download Submit
memory/3048-146-0x00000000037A0000-0x0000000003943000-memory.dmp

Filesize
1.6MB

Download
memory/3048-135-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3048-141-0x0000000002CF0000-0x0000000002D4D000-memory.dmp

Filesize
372KB

Download
memory/3048-142-0x0000000002CF0000-0x0000000002D4D000-memory.dmp

Filesize
372KB

Download
memory/3048-144-0x0000000002CF0000-0x0000000002D4D000-memory.dmp

Filesize
372KB

Download
memory/3048-133-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3048-145-0x0000000002280000-0x0000000002283000-memory.dmp

Filesize
12KB

Download
memory/3048-136-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3048-134-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3048-168-0x00000000041E0000-0x00000000042CC000-memory.dmp

Filesize
944KB

Download
memory/3048-169-0x0000000002CF0000-0x0000000002D4D000-memory.dmp

Filesize
372KB

Download
memory/3048-170-0x00000000041E0000-0x00000000042CC000-memory.dmp

Filesize
944KB

Download
memory/3048-172-0x0000000002F40000-0x0000000003030000-memory.dmp

Filesize
960KB

Download
memory/3048-175-0x0000000003580000-0x0000000003795000-memory.dmp

Filesize
2.1MB

Download
memory/3048-174-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3048-171-0x0000000002CF0000-0x0000000002D4D000-memory.dmp

Filesize
372KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads