blackmoon | e267102a61e6b23a856b351e23042f002b1743e0845fd3ab5f7f2e14b14813fc

Analysis

max time kernel
85s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2023, 07:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e267102a61e6b23a856b351e23042f002b1743e0845fd3ab5f7f2e14b14813fc.exe
Size 245KB
Sample230311-jk67fagh55
SHA256 e267102a61e6b23a856b351e23042f002b1743e0845fd3ab5f7f2e14b14813fc
MD5 a1b5db348d455b61166c195b497613ed
SHA1 5fb8d784f553d91d404bf0d888593d8ea24faa13
SHA512 bb1cbe87cf5081c6f4f92d9f4e057820ff81428fcf0ddf2a9e651c59973c55532ecb617fe84f6fb0d2cd01ce306e0e69d3202b34ec4e9ab3897c10da5a05e189
SSDEEP 3072:Bft58XspVgsikEws3SdAhhr0e25n69Hs0FAg0FuX4tHw7UfEkGxxxxD:BfP88qQdk0R5n69HsKAOzQls
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackmoon banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023159-149.dat	family_blackmoon

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	e267102a61e6b23a856b351e23042f002b1743e0845fd3ab5f7f2e14b14813fc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\e267102a61e6b23a856b351e23042f002b1743e0845fd3ab5f7f2e14b14813fc.exe
"C:\Users\Admin\AppData\Local\Temp\e267102a61e6b23a856b351e23042f002b1743e0845fd3ab5f7f2e14b14813fc.exe"
1⤵
- Drops file in Program Files directory
PID:4840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HD_C.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_C.dat
Size 245KB
SHA256 e267102a61e6b23a856b351e23042f002b1743e0845fd3ab5f7f2e14b14813fc
MD5 a1b5db348d455b61166c195b497613ed
SHA1 5fb8d784f553d91d404bf0d888593d8ea24faa13
SHA512 bb1cbe87cf5081c6f4f92d9f4e057820ff81428fcf0ddf2a9e651c59973c55532ecb617fe84f6fb0d2cd01ce306e0e69d3202b34ec4e9ab3897c10da5a05e189
SSDEEP 3072:Bft58XspVgsikEws3SdAhhr0e25n69Hs0FAg0FuX4tHw7UfEkGxxxxD:BfP88qQdk0R5n69HsKAOzQls
MD5 SHA1 SHA512 SSDEEP

Submit Download