blackmoon | 7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8

General

Target

7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
Size

159KB
MD5

9817350719ad28a06cc16e638f4780f4
SHA1

96a0a69291180ab55b20e6aafc09af8d6810c283
SHA256

7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8
SHA512

800db2672382b8f6f4f384e2b4a59a09b61ec7e87f1cb37adf51e0203e61e21c23c35fbb71541a59e42fe247ea083ab871bb85252ccfffee48232e8ccb46bd51
SSDEEP

3072:SV8s89ENEbWT7NApW1aru+41GKe3ZvhYQ9SJ9BQt7QV2BS9t1ca/QclT7:SZbWWT7NAkJrpe3ZKWBt7QV2It1fl3

Score

10^/10

blackmoon gh0strat banker persistence rat trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 9 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2032-54-0x0000000000400000-0x000000000048B000-memory.dmp	family_blackmoon
behavioral1/memory/2032-59-0x0000000000400000-0x000000000048B000-memory.dmp	family_blackmoon
behavioral1/memory/2032-61-0x00000000003B0000-0x00000000003E8000-memory.dmp	family_blackmoon
behavioral1/memory/2032-66-0x0000000001F00000-0x0000000001F66000-memory.dmp	family_blackmoon
behavioral1/memory/2032-65-0x0000000001F00000-0x0000000001F66000-memory.dmp	family_blackmoon
behavioral1/memory/2032-68-0x0000000001F00000-0x0000000001F66000-memory.dmp	family_blackmoon
behavioral1/memory/2032-106-0x0000000001F00000-0x0000000001F66000-memory.dmp	family_blackmoon
behavioral1/memory/2032-108-0x0000000001F00000-0x0000000001F66000-memory.dmp	family_blackmoon
behavioral1/memory/2032-110-0x00000000003B0000-0x00000000003E8000-memory.dmp	family_blackmoon

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2032-93-0x0000000010000000-0x0000000010017000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Loads dropped DLL 2 IoCs

Processes:

7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe

pid	process
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdatem = "C:\\Users\\Public\\Documents\\Applicationjeqae.exe"	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe

description	ioc	process
File opened (read-only)	\??\S:	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
File opened (read-only)	\??\E:	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
File opened (read-only)	\??\F:	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
File opened (read-only)	\??\I:	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
File opened (read-only)	\??\M:	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
File opened (read-only)	\??\N:	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
File opened (read-only)	\??\P:	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
File opened (read-only)	\??\Q:	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
File opened (read-only)	\??\V:	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
File opened (read-only)	\??\X:	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
File opened (read-only)	\??\B:	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
File opened (read-only)	\??\G:	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
File opened (read-only)	\??\L:	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
File opened (read-only)	\??\O:	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
File opened (read-only)	\??\U:	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
File opened (read-only)	\??\W:	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
File opened (read-only)	\??\Y:	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
File opened (read-only)	\??\H:	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
File opened (read-only)	\??\J:	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
File opened (read-only)	\??\K:	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
File opened (read-only)	\??\R:	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
File opened (read-only)	\??\Z:	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
File opened (read-only)	\??\T:	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

332 NOTEPAD.EXE

pid	process
332	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 41 IoCs

Processes:

7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe

pid	process
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe

pid process

2032 7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe

description	pid	process
Token: 33	2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
Token: SeIncBasePriorityPrivilege	2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
Token: 33	2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
Token: SeIncBasePriorityPrivilege	2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe

pid	process
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe

pid process

2032 7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe

description	pid	process	target process
PID 2032 wrote to memory of 332	2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe	NOTEPAD.EXE
PID 2032 wrote to memory of 332	2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe	NOTEPAD.EXE
PID 2032 wrote to memory of 332	2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe	NOTEPAD.EXE
PID 2032 wrote to memory of 332	2032	7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe	NOTEPAD.EXE

C:\Users\Admin\AppData\Local\Temp\7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe
"C:\Users\Admin\AppData\Local\Temp\7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.txt
2⤵
- Opens file in notepad (likely ransom note)
PID:332

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ff002e35c7433be31f9ec5ca0b6d64ba6b8d92072893a3d708e7e94879af8a8.txt
Filesize
120KB

MD5
3aea5b78bac5359a799c2714fecccd1a

SHA1
5d3203b328ecfc7a55c0ded1032d209e9f273367

SHA256
c05e763cab67cf9daf5be7a6a6cff2650223987a9693eaa119f69b2bbb6df6c3

SHA512
9513cc84a7ed3dd709d4affb03f6e286dcd43e82f33441c00a9d74d2b45449f2ee20baa8db46218d7a59d9e62fb7f95050ea305166e70f3e71dde39ccf07b6d3

Download Submit
C:\Users\Public\Documents\sjsw.log
Filesize
247B

MD5
b8c478f7d39940bcc177adc89db54c73

SHA1
d12648be9559dfcb07e660ecd704cbab4989038d

SHA256
11fa3c7397e292cf756edf3d9ca36646c60999e4455bd7c5273821950effa424

SHA512
cd22f880a6c556311ddf2622a6bf00f299d43babffb6eb65c59e97e33c2c4182d2c41075314fb4e34ee6f35d4a574f6d34ff7212c704914afbe96c26f318a2b2

Download Submit
\Users\Admin\AppData\Local\Temp\aaaty.dll
Filesize
2KB

MD5
7943effe67a4647e06def2348949020e

SHA1
eabd561f0639a975de259633f63896d82c3f878d

SHA256
3fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa

SHA512
c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003

Download Submit
\Users\Public\Documents\twwc.dll
Filesize
2KB

MD5
7943effe67a4647e06def2348949020e

SHA1
eabd561f0639a975de259633f63896d82c3f878d

SHA256
3fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa

SHA512
c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003

Download Submit
memory/2032-65-0x0000000001F00000-0x0000000001F66000-memory.dmp

Filesize
408KB

Download
memory/2032-66-0x0000000001F00000-0x0000000001F66000-memory.dmp

Filesize
408KB

Download
memory/2032-90-0x0000000003AB0000-0x0000000003BA2000-memory.dmp

Filesize
968KB

Download
memory/2032-91-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2032-68-0x0000000001F00000-0x0000000001F66000-memory.dmp

Filesize
408KB

Download
memory/2032-69-0x0000000000340000-0x0000000000343000-memory.dmp

Filesize
12KB

Download
memory/2032-59-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2032-61-0x00000000003B0000-0x00000000003E8000-memory.dmp

Filesize
224KB

Download
memory/2032-110-0x00000000003B0000-0x00000000003E8000-memory.dmp

Filesize
224KB

Download
memory/2032-54-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2032-60-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2032-92-0x0000000003AB0000-0x0000000003BA2000-memory.dmp

Filesize
968KB

Download
memory/2032-93-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/2032-96-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2032-106-0x0000000001F00000-0x0000000001F66000-memory.dmp

Filesize
408KB

Download
memory/2032-108-0x0000000001F00000-0x0000000001F66000-memory.dmp

Filesize
408KB

Download
memory/2032-109-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2032-89-0x0000000003AB0000-0x0000000003BA2000-memory.dmp

Filesize
968KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads