blackmoon | 2dff2fb200ea47a245cebc2dee72f595e30957b59725bdbca8cdc3225a449a72

Analysis

max time kernel
69s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25-02-2023 12:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2dff2fb200ea47a245cebc2dee72f595e30957b59725bdbca8cdc3225a449a72.exe
Size

83KB
MD5

bd3c295ce6e20d9f10fcfd093732bb11
SHA1

55c2d80f459fc9c4b4562ff837c437894cbd7284
SHA256

2dff2fb200ea47a245cebc2dee72f595e30957b59725bdbca8cdc3225a449a72
SHA512

f74e977621c3a64bc4da87e557b278be6cfcd40fad1befe4ea2970bd366cda3f5cd746cae44e4d525e968b8f939b9978a65d424ea59f0ba2af2e65e4b2894f60
SSDEEP

1536:a94OZH9ziYXyeM2enykKXbFsv7EVqOjPNQ70dW9KRTBKKjncHnouy8dl:2HdGYlMixZsDAqOjPN/cKRTB1cHoutr

Score

10^/10

blackmoon banker bootkit persistence trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2244-134-0x0000000000400000-0x0000000000438000-memory.dmp	family_blackmoon

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2244-133-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral2/memory/2244-134-0x0000000000400000-0x0000000000438000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

2dff2fb200ea47a245cebc2dee72f595e30957b59725bdbca8cdc3225a449a72.exe

description ioc process

File opened for modification \??\PhysicalDrive0 2dff2fb200ea47a245cebc2dee72f595e30957b59725bdbca8cdc3225a449a72.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

452 2244 WerFault.exe 2dff2fb200ea47a245cebc2dee72f595e30957b59725bdbca8cdc3225a449a72.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2dff2fb200ea47a245cebc2dee72f595e30957b59725bdbca8cdc3225a449a72.exe

description pid process

Token: SeDebugPrivilege 2244 2dff2fb200ea47a245cebc2dee72f595e30957b59725bdbca8cdc3225a449a72.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	2dff2fb200ea47a245cebc2dee72f595e30957b59725bdbca8cdc3225a449a72.exe

pid	pid_target	process	target process
452	2244	WerFault.exe	2dff2fb200ea47a245cebc2dee72f595e30957b59725bdbca8cdc3225a449a72.exe

description	pid	process
Token: SeDebugPrivilege	2244	2dff2fb200ea47a245cebc2dee72f595e30957b59725bdbca8cdc3225a449a72.exe

C:\Users\Admin\AppData\Local\Temp\2dff2fb200ea47a245cebc2dee72f595e30957b59725bdbca8cdc3225a449a72.exe
"C:\Users\Admin\AppData\Local\Temp\2dff2fb200ea47a245cebc2dee72f595e30957b59725bdbca8cdc3225a449a72.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 272
2⤵
- Program crash
PID:452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2244 -ip 2244
1⤵
PID:4052

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2244-133-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2244-134-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download