blackmoon | 0acb6500c0f62135d28021fc772a86aed77eba455465adc0d088c66932ece2d0

Analysis

max time kernel
38s
max time network
151s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19-05-2023 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

10.0MB
MD5

09db16bbb023ca324bae100c625d1635
SHA1

444993b228e57c3cd58b64dddfd901f4bff77da3
SHA256

0acb6500c0f62135d28021fc772a86aed77eba455465adc0d088c66932ece2d0
SHA512

dfc8ae471c4d5ad67876ef259de9aaf3ced8ff65e0526641c7bc555cda8449ae95df1bc7cb246aabf5cabe3890e70795525386aefb19d98d1c2c36ced91917e1
SSDEEP

98304:xyvdNBhN3aeLgtV9J+UMhN2diFNJm2itQQEkf8dnjcmTvmMcZIuqdu7ATF+kMuGH:xUTarnMf2G+aQj8djcivVcETF+kMIC

Score

10^/10

blackmoon banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1504-61-0x0000000010000000-0x000000001005D000-memory.dmp	family_blackmoon
behavioral1/memory/1504-74-0x0000000010000000-0x000000001005D000-memory.dmp	family_blackmoon

Downloads MZ/PE file

Drops file in Drivers directory 10 IoCs

Processes:

tmp.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\qHjQqRkN.dll	tmp.exe
File opened for modification	C:\Windows\SysWOW64\drivers\qHjQqRkN.dll	tmp.exe
File opened for modification	C:\Windows\System32\drivers\aOgJsLbI.dll	tmp.exe
File opened for modification	C:\Windows\SysWOW64\drivers\sHpDqDyZ.dll	tmp.exe
File created	C:\Windows\System32\drivers\ReipC49ipC	tmp.exe
File opened for modification	C:\Windows\System32\drivers\ReipC49ipC	tmp.exe
File created	C:\Windows\SysWOW64\drivers\aOgJsLbI.dll	tmp.exe
File created	C:\Windows\SysWOW64\drivers\sHpDqDyZ.dll	tmp.exe
File created	C:\Windows\System32\drivers\RecpF50cpF	tmp.exe
File opened for modification	C:\Windows\System32\drivers\RecpF50cpF	tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

tmp.exe

pid process

1504 tmp.exe
1504 tmp.exe
1504 tmp.exe
Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

460
460
Suspicious behavior: RenamesItself 1 IoCs

Processes:

tmp.exe

pid process

1504 tmp.exe

pid	process
1504	tmp.exe
1504	tmp.exe
1504	tmp.exe

pid	process
460
460

pid	process
1504	tmp.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

tmp.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	1504	tmp.exe
Token: 33	1596	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1596	AUDIODG.EXE
Token: 33	1596	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1596	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

tmp.exe

pid process

1504 tmp.exe
1504 tmp.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

tmp.exe

pid process

1504 tmp.exe
1504 tmp.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

tmp.exe

pid process

1504 tmp.exe
1504 tmp.exe

pid	process
1504	tmp.exe
1504	tmp.exe

pid	process
1504	tmp.exe
1504	tmp.exe

pid	process
1504	tmp.exe
1504	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1504

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x528
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1596

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\drivers\RecpF50cpF
Filesize
63KB

MD5
73919ef9b3dac69301729cd8bf02ff5c

SHA1
ec809efa4412c3dc8e9c363bbef08efb9335aa5b

SHA256
e5869f427fec9843be68e8aa991b44cd2d0d0425345ba7e2bddbf2369ec1903c

SHA512
531e88fbdfc75ef6c2a85ca073853aff010de9e262395d50d4bc07c336f7311f828aa214ab0d4f8849a94a2ae93c138a6ed27a9a70240bf8593812730c18c8eb

Download Submit
memory/1504-70-0x0000000002CC0000-0x0000000002D00000-memory.dmp

Filesize
256KB

Download
memory/1504-72-0x0000000002CC0000-0x0000000002D00000-memory.dmp

Filesize
256KB

Download
memory/1504-67-0x0000000002CC0000-0x0000000002D00000-memory.dmp

Filesize
256KB

Download
memory/1504-68-0x0000000002CC0000-0x0000000002D00000-memory.dmp

Filesize
256KB

Download
memory/1504-69-0x0000000002CC0000-0x0000000002D00000-memory.dmp

Filesize
256KB

Download
memory/1504-61-0x0000000010000000-0x000000001005D000-memory.dmp

Filesize
372KB

Download
memory/1504-71-0x0000000002CC0000-0x0000000002D00000-memory.dmp

Filesize
256KB

Download
memory/1504-63-0x0000000002CC0000-0x0000000002D00000-memory.dmp

Filesize
256KB

Download
memory/1504-73-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

Filesize
4KB

Download
memory/1504-74-0x0000000010000000-0x000000001005D000-memory.dmp

Filesize
372KB

Download
memory/1504-78-0x0000000002CC0000-0x0000000002D00000-memory.dmp

Filesize
256KB

Download
memory/1504-62-0x0000000002CC0000-0x0000000002D00000-memory.dmp

Filesize
256KB

Download
memory/1504-83-0x0000000002CC0000-0x0000000002D00000-memory.dmp

Filesize
256KB

Download
memory/1504-84-0x0000000002CC0000-0x0000000002D00000-memory.dmp

Filesize
256KB

Download