blackmoon | 2ea1cb29cfa1a2dfec0cd18651c8bf858b56202b7c7a9aae60f5e4ff8fa74b94

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2023 11:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

9.8MB
MD5

7a775ccd920f657a019f09809f88112a
SHA1

be7e900d46eef547a233b5ed3ddf2249739d3ab6
SHA256

2ea1cb29cfa1a2dfec0cd18651c8bf858b56202b7c7a9aae60f5e4ff8fa74b94
SHA512

49a57b62216503574fb773e49a0248a9ac5e3b70566b3cdab3021c614c042c0109da27cbf34ae089425c604a09a78e898e18bb37e8a9b918f44ec8784c7acb0b
SSDEEP

196608:m4z7KSOJfgdGpzzlkXWHCNpoGcLepVAblz02Q6Z0:mk7Kf4MBaXgCDoGc6SYHZ

Score

10^/10

blackmoon banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2124-144-0x0000000008BA0000-0x000000000907A000-memory.dmp	family_blackmoon
behavioral2/memory/2124-150-0x0000000010000000-0x0000000010390000-memory.dmp	family_blackmoon
behavioral2/memory/2124-151-0x0000000009080000-0x00000000090DD000-memory.dmp	family_blackmoon
behavioral2/memory/2124-162-0x0000000009080000-0x00000000090DD000-memory.dmp	family_blackmoon

Downloads MZ/PE file

Drops file in Drivers directory 16 IoCs

Processes:

tmp.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\drivers\xMoDdRgA.dll	tmp.exe
File created	C:\Windows\SysWOW64\drivers\wIgMgHuC.dll	tmp.exe
File created	C:\Windows\SysWOW64\drivers\fAlYnCpZ.dll	tmp.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fAlYnCpZ.dll	tmp.exe
File created	C:\Windows\System32\drivers\ReUxi34Uxi	tmp.exe
File created	C:\Windows\SysWOW64\drivers\cJdLvSnT.dll	tmp.exe
File opened for modification	C:\Windows\SysWOW64\drivers\cJdLvSnT.dll	tmp.exe
File created	C:\Windows\SysWOW64\drivers\dUlEfViV.dll	tmp.exe
File created	C:\Windows\System32\drivers\ReFgb31Fgb	tmp.exe
File opened for modification	C:\Windows\System32\drivers\ReFgb31Fgb	tmp.exe
File opened for modification	C:\Windows\SysWOW64\drivers\dUlEfViV.dll	tmp.exe
File created	C:\Windows\SysWOW64\drivers\xMoDdRgA.dll	tmp.exe
File opened for modification	C:\Windows\System32\drivers\wIgMgHuC.dll	tmp.exe
File created	C:\Windows\SysWOW64\drivers\zQkLkFwN.dll	tmp.exe
File opened for modification	C:\Windows\System32\drivers\zQkLkFwN.dll	tmp.exe
File opened for modification	C:\Windows\System32\drivers\ReUxi34Uxi	tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

tmp.exe

pid process

2124 tmp.exe
2124 tmp.exe
2124 tmp.exe
2124 tmp.exe
2124 tmp.exe
2124 tmp.exe
2124 tmp.exe
2124 tmp.exe
Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

652
652
Suspicious behavior: RenamesItself 1 IoCs

Processes:

tmp.exe

pid process

2124 tmp.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

tmp.exe

description pid process

Token: SeDebugPrivilege 2124 tmp.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

tmp.exe

pid process

2124 tmp.exe
2124 tmp.exe
2124 tmp.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

tmp.exe

pid process

2124 tmp.exe
2124 tmp.exe
2124 tmp.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

tmp.exe

pid process

2124 tmp.exe
2124 tmp.exe

pid	process
2124	tmp.exe
2124	tmp.exe
2124	tmp.exe
2124	tmp.exe
2124	tmp.exe
2124	tmp.exe
2124	tmp.exe
2124	tmp.exe

pid	process
652
652

pid	process
2124	tmp.exe

description	pid	process
Token: SeDebugPrivilege	2124	tmp.exe

pid	process
2124	tmp.exe
2124	tmp.exe
2124	tmp.exe

pid	process
2124	tmp.exe
2124	tmp.exe
2124	tmp.exe

pid	process
2124	tmp.exe
2124	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2124

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\drivers\zQkLkFwN.dll
Filesize
28B

MD5
6c7e84cb1a40e1e6a5cfe37e2ceaad04

SHA1
a2781444bb3c55196292df729b01be707ec1953a

SHA256
c6bf69533d3fc2c00d2e601726411163cae0e6cb168662eb6a58b492a25b042c

SHA512
97c9bc007beda6e6ea9c9aeea3f4033fe77304d5417a9f9f97ede9ed168f7259053f5861227a3a7eaa4859d1d1a7898705b0f8aae9527b4b607ab205e3b6e9aa

Download Submit
C:\Windows\System32\drivers\ReUxi34Uxi
Filesize
63KB

MD5
73919ef9b3dac69301729cd8bf02ff5c

SHA1
ec809efa4412c3dc8e9c363bbef08efb9335aa5b

SHA256
e5869f427fec9843be68e8aa991b44cd2d0d0425345ba7e2bddbf2369ec1903c

SHA512
531e88fbdfc75ef6c2a85ca073853aff010de9e262395d50d4bc07c336f7311f828aa214ab0d4f8849a94a2ae93c138a6ed27a9a70240bf8593812730c18c8eb

Download Submit
memory/2124-133-0x0000000000400000-0x0000000000DFF000-memory.dmp

Filesize
10.0MB

Download
memory/2124-144-0x0000000008BA0000-0x000000000907A000-memory.dmp

Filesize
4.9MB

Download
memory/2124-150-0x0000000010000000-0x0000000010390000-memory.dmp

Filesize
3.6MB

Download
memory/2124-151-0x0000000009080000-0x00000000090DD000-memory.dmp

Filesize
372KB

Download
memory/2124-155-0x0000000000400000-0x0000000000DFF000-memory.dmp

Filesize
10.0MB

Download
memory/2124-162-0x0000000009080000-0x00000000090DD000-memory.dmp

Filesize
372KB

Download