blackmoon | aed9408697a619e4181867f82a61f20ddbb1c3d3ff4816460b494b854ffa96cb

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2023 23:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aed9408697a619e4181867f82a61f20ddbb1c3d3ff4816460b494b854ffa96cb.exe
Size

5.8MB
MD5

92b1f3882505126b22e90978af46ba89
SHA1

9f25598e120d5ac69051c69700baaa0d35d5d0ec
SHA256

aed9408697a619e4181867f82a61f20ddbb1c3d3ff4816460b494b854ffa96cb
SHA512

854b817b4eab45b31b862466e22eb87b589d09596d8e21d737747697f126fdce9e271907c2190da0212c25e85f2fc805c557fe80bf20430ffbd9f2f901f4ece9
SSDEEP

98304:HyHLvyloQjQe/XoN8ESMy3NkPLmy+NKQO/w2RJtqCWKR:HyHLvgoHeW8ESjuDmylw2RJw6R

Score

10^/10

blackmoon aspackv2 banker bootkit persistence trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 16 IoCs

resource	yara_rule
behavioral2/memory/4228-136-0x0000000000400000-0x000000000134B000-memory.dmp	family_blackmoon
behavioral2/memory/4228-185-0x0000000000400000-0x000000000134B000-memory.dmp	family_blackmoon
behavioral2/memory/4228-186-0x0000000000400000-0x000000000134B000-memory.dmp	family_blackmoon
behavioral2/memory/4228-187-0x0000000000400000-0x000000000134B000-memory.dmp	family_blackmoon
behavioral2/memory/4228-188-0x0000000000400000-0x000000000134B000-memory.dmp	family_blackmoon
behavioral2/memory/4228-189-0x0000000000400000-0x000000000134B000-memory.dmp	family_blackmoon
behavioral2/memory/4228-190-0x0000000000400000-0x000000000134B000-memory.dmp	family_blackmoon
behavioral2/memory/4228-191-0x0000000000400000-0x000000000134B000-memory.dmp	family_blackmoon
behavioral2/memory/4228-192-0x0000000000400000-0x000000000134B000-memory.dmp	family_blackmoon
behavioral2/memory/4228-193-0x0000000000400000-0x000000000134B000-memory.dmp	family_blackmoon
behavioral2/memory/4228-194-0x0000000000400000-0x000000000134B000-memory.dmp	family_blackmoon
behavioral2/memory/4228-195-0x0000000000400000-0x000000000134B000-memory.dmp	family_blackmoon
behavioral2/memory/4228-196-0x0000000000400000-0x000000000134B000-memory.dmp	family_blackmoon
behavioral2/memory/4228-197-0x0000000000400000-0x000000000134B000-memory.dmp	family_blackmoon
behavioral2/memory/4228-198-0x0000000000400000-0x000000000134B000-memory.dmp	family_blackmoon
behavioral2/memory/4228-199-0x0000000000400000-0x000000000134B000-memory.dmp	family_blackmoon

Downloads MZ/PE file

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000200000001e2af-137.dat	aspack_v212_v242
behavioral2/files/0x000200000001e2af-135.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	nFBRhW.exe

Executes dropped EXE 1 IoCs

pid	Process
1072	nFBRhW.exe

Loads dropped DLL 1 IoCs

pid	Process
4228	aed9408697a619e4181867f82a61f20ddbb1c3d3ff4816460b494b854ffa96cb.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4228-136-0x0000000000400000-0x000000000134B000-memory.dmp	upx
behavioral2/memory/4228-185-0x0000000000400000-0x000000000134B000-memory.dmp	upx
behavioral2/memory/4228-186-0x0000000000400000-0x000000000134B000-memory.dmp	upx
behavioral2/memory/4228-187-0x0000000000400000-0x000000000134B000-memory.dmp	upx
behavioral2/memory/4228-188-0x0000000000400000-0x000000000134B000-memory.dmp	upx
behavioral2/memory/4228-189-0x0000000000400000-0x000000000134B000-memory.dmp	upx
behavioral2/memory/4228-190-0x0000000000400000-0x000000000134B000-memory.dmp	upx
behavioral2/memory/4228-191-0x0000000000400000-0x000000000134B000-memory.dmp	upx
behavioral2/memory/4228-192-0x0000000000400000-0x000000000134B000-memory.dmp	upx
behavioral2/memory/4228-193-0x0000000000400000-0x000000000134B000-memory.dmp	upx
behavioral2/memory/4228-194-0x0000000000400000-0x000000000134B000-memory.dmp	upx
behavioral2/memory/4228-195-0x0000000000400000-0x000000000134B000-memory.dmp	upx
behavioral2/memory/4228-196-0x0000000000400000-0x000000000134B000-memory.dmp	upx
behavioral2/memory/4228-197-0x0000000000400000-0x000000000134B000-memory.dmp	upx
behavioral2/memory/4228-198-0x0000000000400000-0x000000000134B000-memory.dmp	upx
behavioral2/memory/4228-199-0x0000000000400000-0x000000000134B000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	aed9408697a619e4181867f82a61f20ddbb1c3d3ff4816460b494b854ffa96cb.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	nFBRhW.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	nFBRhW.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	nFBRhW.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	nFBRhW.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	nFBRhW.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	nFBRhW.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	nFBRhW.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	nFBRhW.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	nFBRhW.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	nFBRhW.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	nFBRhW.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	nFBRhW.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	nFBRhW.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	nFBRhW.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe	nFBRhW.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	nFBRhW.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	nFBRhW.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	nFBRhW.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	nFBRhW.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe	nFBRhW.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	nFBRhW.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	nFBRhW.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe	nFBRhW.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	nFBRhW.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	nFBRhW.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	nFBRhW.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4228	aed9408697a619e4181867f82a61f20ddbb1c3d3ff4816460b494b854ffa96cb.exe
4228	aed9408697a619e4181867f82a61f20ddbb1c3d3ff4816460b494b854ffa96cb.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 1072	4228	aed9408697a619e4181867f82a61f20ddbb1c3d3ff4816460b494b854ffa96cb.exe	84
PID 4228 wrote to memory of 1072	4228	aed9408697a619e4181867f82a61f20ddbb1c3d3ff4816460b494b854ffa96cb.exe	84
PID 4228 wrote to memory of 1072	4228	aed9408697a619e4181867f82a61f20ddbb1c3d3ff4816460b494b854ffa96cb.exe	84
PID 1072 wrote to memory of 3644	1072	nFBRhW.exe	85
PID 1072 wrote to memory of 3644	1072	nFBRhW.exe	85
PID 1072 wrote to memory of 3644	1072	nFBRhW.exe	85

C:\Users\Admin\AppData\Local\Temp\aed9408697a619e4181867f82a61f20ddbb1c3d3ff4816460b494b854ffa96cb.exe
"C:\Users\Admin\AppData\Local\Temp\aed9408697a619e4181867f82a61f20ddbb1c3d3ff4816460b494b854ffa96cb.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Users\Admin\AppData\Local\Temp\nFBRhW.exe
  C:\Users\Admin\AppData\Local\Temp\nFBRhW.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\565448ca.bat" "
    3⤵
    PID:3644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Restart.bat
  2⤵
  PID:3800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4VT6R2QM\k2[1].rar

Filesize
4B

MD5
d3b07384d113edec49eaa6238ad5ff00

SHA1
f1d2d2f924e986ac86fdf7b36c94bcdf32beec15

SHA256
b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c

SHA512
0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\189432AF.exe

Filesize
4B

MD5
20879c987e2f9a916e578386d499f629

SHA1
c7b33ddcc42361fdb847036fc07e880b81935d5d

SHA256
9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31

SHA512
bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

Download Submit
C:\Users\Admin\AppData\Local\Temp\565448ca.bat

Filesize
187B

MD5
151dfc3d434fcb9792482c1465baef3b

SHA1
f967534e5937121d3c1902f4bfef59a9d9f02227

SHA256
4ee211f0cd1e643a0bc2bc51498c68e9fa422f59d13d324c15423e01b3b7003f

SHA512
30f838146be48224ae508e80c6147661b348f2dbb3de3f9174b451e5196846a71a4bbbda99c388c2858a4199762d60b5d3a59f1035de5630e9f6e67441db0ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\E2EECore.2.7.2.dll

Filesize
8.4MB

MD5
8b6c94bbdbfb213e94a5dcb4fac28ce3

SHA1
b56102ca4f03556f387f8b30e2b404efabe0cb65

SHA256
982a177924762f270b36fe34c7d6847392b48ae53151dc2011078dceef487a53

SHA512
9d6d63b5d8cf7a978d7e91126d7a343c2f7acd00022da9d692f63e50835fdd84a59a93328564f10622f2b1f6adfd7febdd98b8ddb294d0754ed45cc9c165d25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nFBRhW.exe

Filesize
15KB

MD5
7a6e4230a06062a30fce28ecfbbabf8f

SHA1
c4609df76a9f98a34f86ffde0c35789b18388bbf

SHA256
3cd39fc206e0ba2bfae28907f85bf99e853305e16003964b78e762b568a12c74

SHA512
ddb65a9d60229976b70c74ba5fd698dd676bd5d5bd69c2cc2604ad98bb0b9fdd2bca0a2476fb0eda8eecf8e43786d948da8b9bb20da94190a65655ee14e541d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nFBRhW.exe

Filesize
15KB

MD5
7a6e4230a06062a30fce28ecfbbabf8f

SHA1
c4609df76a9f98a34f86ffde0c35789b18388bbf

SHA256
3cd39fc206e0ba2bfae28907f85bf99e853305e16003964b78e762b568a12c74

SHA512
ddb65a9d60229976b70c74ba5fd698dd676bd5d5bd69c2cc2604ad98bb0b9fdd2bca0a2476fb0eda8eecf8e43786d948da8b9bb20da94190a65655ee14e541d1

Download Submit
memory/1072-139-0x0000000000EA0000-0x0000000000EA9000-memory.dmp

Filesize
36KB

Download
memory/1072-178-0x0000000000EA0000-0x0000000000EA9000-memory.dmp

Filesize
36KB

Download
memory/4228-188-0x0000000000400000-0x000000000134B000-memory.dmp

Filesize
15.3MB

Download
memory/4228-191-0x0000000000400000-0x000000000134B000-memory.dmp

Filesize
15.3MB

Download
memory/4228-186-0x0000000000400000-0x000000000134B000-memory.dmp

Filesize
15.3MB

Download
memory/4228-187-0x0000000000400000-0x000000000134B000-memory.dmp

Filesize
15.3MB

Download
memory/4228-136-0x0000000000400000-0x000000000134B000-memory.dmp

Filesize
15.3MB

Download
memory/4228-189-0x0000000000400000-0x000000000134B000-memory.dmp

Filesize
15.3MB

Download
memory/4228-190-0x0000000000400000-0x000000000134B000-memory.dmp

Filesize
15.3MB

Download
memory/4228-185-0x0000000000400000-0x000000000134B000-memory.dmp

Filesize
15.3MB

Download
memory/4228-192-0x0000000000400000-0x000000000134B000-memory.dmp

Filesize
15.3MB

Download
memory/4228-193-0x0000000000400000-0x000000000134B000-memory.dmp

Filesize
15.3MB

Download
memory/4228-194-0x0000000000400000-0x000000000134B000-memory.dmp

Filesize
15.3MB

Download
memory/4228-195-0x0000000000400000-0x000000000134B000-memory.dmp

Filesize
15.3MB

Download
memory/4228-196-0x0000000000400000-0x000000000134B000-memory.dmp

Filesize
15.3MB

Download
memory/4228-197-0x0000000000400000-0x000000000134B000-memory.dmp

Filesize
15.3MB

Download
memory/4228-198-0x0000000000400000-0x000000000134B000-memory.dmp

Filesize
15.3MB

Download
memory/4228-199-0x0000000000400000-0x000000000134B000-memory.dmp

Filesize
15.3MB

Download