Overview

overview

10

Static

static

7

1d381bb52634f826.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1d381bb52634f826.exe

  • Size

    285KB

  • Sample

    230616-h7zkfadc9z

  • MD5

    e72c60640dbe31fce8b08d8190282763

  • SHA1

    476fd543dbb50cd60ea189369cc5014c1b7811d4

  • SHA256

    0582b53407ec1509be024523fc82ac8a1d528bd670e931542f81dea17e347bc4

  • SHA512

    19a40c4ff023a8109bb9b9c5cadd3e5a1b257ecab5c53fe7bb07520f8e8984d6128bad68863b54a23cf1982a2b6e0ae7fedc8375fab4033a7eaf4436f0ee6b92

  • SSDEEP

    6144:LMYVjTqJ0dIS8l2I9FIs5oGHs+xgjhK2BV+L0CNCWiZnDoS:LMYpqMIfTKd+xYBAL0CALDoS

Score
10/10
blackmoonbankermicrosoftdiscoverypersistencephishingtrojanupx

Malware Config

Targets

    • Target

      1d381bb52634f826.exe

    • Size

      285KB

    • MD5

      e72c60640dbe31fce8b08d8190282763

    • SHA1

      476fd543dbb50cd60ea189369cc5014c1b7811d4

    • SHA256

      0582b53407ec1509be024523fc82ac8a1d528bd670e931542f81dea17e347bc4

    • SHA512

      19a40c4ff023a8109bb9b9c5cadd3e5a1b257ecab5c53fe7bb07520f8e8984d6128bad68863b54a23cf1982a2b6e0ae7fedc8375fab4033a7eaf4436f0ee6b92

    • SSDEEP

      6144:LMYVjTqJ0dIS8l2I9FIs5oGHs+xgjhK2BV+L0CNCWiZnDoS:LMYpqMIfTKd+xYBAL0CALDoS

    Score
    10/10
    blackmoonbankermicrosoftdiscoverypersistencephishingtrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Registers COM server for autorun

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Detected potential entity reuse from brand microsoft.

      phishingmicrosoft

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3
T1060

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

5
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

5
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks