blackmoon | 0acb6500c0f62135d28021fc772a86aed77eba455465adc0d088c66932ece2d0

Analysis

max time kernel
60s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2023 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

10.0MB
MD5

09db16bbb023ca324bae100c625d1635
SHA1

444993b228e57c3cd58b64dddfd901f4bff77da3
SHA256

0acb6500c0f62135d28021fc772a86aed77eba455465adc0d088c66932ece2d0
SHA512

dfc8ae471c4d5ad67876ef259de9aaf3ced8ff65e0526641c7bc555cda8449ae95df1bc7cb246aabf5cabe3890e70795525386aefb19d98d1c2c36ced91917e1
SSDEEP

98304:xyvdNBhN3aeLgtV9J+UMhN2diFNJm2itQQEkf8dnjcmTvmMcZIuqdu7ATF+kMuGH:xUTarnMf2G+aQj8djcivVcETF+kMIC

Score

10^/10

blackmoon banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1008-144-0x0000000010000000-0x00000000105A1000-memory.dmp	family_blackmoon
behavioral2/memory/1008-151-0x00000000041D0000-0x0000000004A40000-memory.dmp	family_blackmoon
behavioral2/memory/1008-157-0x0000000004A60000-0x0000000004ABD000-memory.dmp	family_blackmoon
behavioral2/memory/1008-177-0x0000000010000000-0x00000000105A1000-memory.dmp	family_blackmoon
behavioral2/memory/1008-182-0x0000000004A60000-0x0000000004ABD000-memory.dmp	family_blackmoon

Downloads MZ/PE file

Drops file in Drivers directory 16 IoCs

Processes:

tmp.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\dTdGyHjN.dll	tmp.exe
File opened for modification	C:\Windows\System32\drivers\vQuKyGxZ.dll	tmp.exe
File created	C:\Windows\SysWOW64\drivers\aIzDwMfI.dll	tmp.exe
File created	C:\Windows\System32\drivers\ReypQ2ypQ	tmp.exe
File opened for modification	C:\Windows\SysWOW64\drivers\jRjMqDvQ.dll	tmp.exe
File created	C:\Windows\SysWOW64\drivers\dTdGyHjN.dll	tmp.exe
File created	C:\Windows\SysWOW64\drivers\jRjMqDvQ.dll	tmp.exe
File opened for modification	C:\Windows\System32\drivers\ReywF15ywF	tmp.exe
File created	C:\Windows\System32\drivers\ReywF15ywF	tmp.exe
File opened for modification	C:\Windows\System32\drivers\ReypQ2ypQ	tmp.exe
File opened for modification	C:\Windows\SysWOW64\drivers\tVoVzKqQ.dll	tmp.exe
File opened for modification	C:\Windows\SysWOW64\drivers\aIzDwMfI.dll	tmp.exe
File created	C:\Windows\SysWOW64\drivers\tVoVzKqQ.dll	tmp.exe
File created	C:\Windows\SysWOW64\drivers\vQuKyGxZ.dll	tmp.exe
File created	C:\Windows\SysWOW64\drivers\dKjXbNvH.dll	tmp.exe
File opened for modification	C:\Windows\SysWOW64\drivers\dKjXbNvH.dll	tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

tmp.exe

pid process

1008 tmp.exe
1008 tmp.exe
1008 tmp.exe
1008 tmp.exe
1008 tmp.exe
1008 tmp.exe
1008 tmp.exe
1008 tmp.exe
Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

656
656
Suspicious behavior: RenamesItself 1 IoCs

Processes:

tmp.exe

pid process

1008 tmp.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

tmp.exe

description pid process

Token: SeDebugPrivilege 1008 tmp.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

tmp.exe

pid process

1008 tmp.exe
1008 tmp.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

tmp.exe

pid process

1008 tmp.exe
1008 tmp.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

tmp.exe

pid process

1008 tmp.exe
1008 tmp.exe

pid	process
1008	tmp.exe
1008	tmp.exe
1008	tmp.exe
1008	tmp.exe
1008	tmp.exe
1008	tmp.exe
1008	tmp.exe
1008	tmp.exe

pid	process
656
656

pid	process
1008	tmp.exe

description	pid	process
Token: SeDebugPrivilege	1008	tmp.exe

pid	process
1008	tmp.exe
1008	tmp.exe

pid	process
1008	tmp.exe
1008	tmp.exe

pid	process
1008	tmp.exe
1008	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\drivers\vQuKyGxZ.dll

Filesize
28B

MD5
6c7e84cb1a40e1e6a5cfe37e2ceaad04

SHA1
a2781444bb3c55196292df729b01be707ec1953a

SHA256
c6bf69533d3fc2c00d2e601726411163cae0e6cb168662eb6a58b492a25b042c

SHA512
97c9bc007beda6e6ea9c9aeea3f4033fe77304d5417a9f9f97ede9ed168f7259053f5861227a3a7eaa4859d1d1a7898705b0f8aae9527b4b607ab205e3b6e9aa

Download Submit
C:\Windows\System32\drivers\ReypQ2ypQ

Filesize
63KB

MD5
73919ef9b3dac69301729cd8bf02ff5c

SHA1
ec809efa4412c3dc8e9c363bbef08efb9335aa5b

SHA256
e5869f427fec9843be68e8aa991b44cd2d0d0425345ba7e2bddbf2369ec1903c

SHA512
531e88fbdfc75ef6c2a85ca073853aff010de9e262395d50d4bc07c336f7311f828aa214ab0d4f8849a94a2ae93c138a6ed27a9a70240bf8593812730c18c8eb

Download Submit
memory/1008-142-0x00000000041D0000-0x0000000004A40000-memory.dmp

Filesize
8.4MB

Download
memory/1008-144-0x0000000010000000-0x00000000105A1000-memory.dmp

Filesize
5.6MB

Download
memory/1008-145-0x0000000004090000-0x00000000040D0000-memory.dmp

Filesize
256KB

Download
memory/1008-146-0x0000000004090000-0x00000000040D0000-memory.dmp

Filesize
256KB

Download
memory/1008-147-0x0000000004090000-0x00000000040D0000-memory.dmp

Filesize
256KB

Download
memory/1008-149-0x0000000004090000-0x00000000040D0000-memory.dmp

Filesize
256KB

Download
memory/1008-148-0x0000000004090000-0x00000000040D0000-memory.dmp

Filesize
256KB

Download
memory/1008-150-0x0000000003F60000-0x0000000003F61000-memory.dmp

Filesize
4KB

Download
memory/1008-151-0x00000000041D0000-0x0000000004A40000-memory.dmp

Filesize
8.4MB

Download
memory/1008-157-0x0000000004A60000-0x0000000004ABD000-memory.dmp

Filesize
372KB

Download
memory/1008-158-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-160-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-159-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-161-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-162-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-166-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-167-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-168-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-169-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-171-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-170-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-172-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-173-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-174-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-176-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-175-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-177-0x0000000010000000-0x00000000105A1000-memory.dmp

Filesize
5.6MB

Download
memory/1008-178-0x0000000004090000-0x00000000040D0000-memory.dmp

Filesize
256KB

Download
memory/1008-179-0x0000000004090000-0x00000000040D0000-memory.dmp

Filesize
256KB

Download
memory/1008-180-0x0000000004090000-0x00000000040D0000-memory.dmp

Filesize
256KB

Download
memory/1008-181-0x0000000004090000-0x00000000040D0000-memory.dmp

Filesize
256KB

Download
memory/1008-182-0x0000000004A60000-0x0000000004ABD000-memory.dmp

Filesize
372KB

Download
memory/1008-183-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-184-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-185-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-187-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-186-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-194-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-195-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-197-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-198-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-199-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-200-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-201-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-202-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-203-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-204-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-205-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-206-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1008-207-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download