blackmoon | 9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8

General

Target

9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe
Size

1.1MB
MD5

e714bc2df7e67bfb29a787c5091dd8e1
SHA1

ec3a651cfbd6aed23068f618179e8ea44beb74e8
SHA256

9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8
SHA512

3fd4e6cfae4d68e2a71ef6ef518ed721d19ffa4f8987db239aeafb1dbeb475e04d536d64b30891b47c63f975daed33009347eae2dcdb58429f27e610d76a807b
SSDEEP

24576:O99tRrQzFIuP7oJPyqlHHE7dndAZojUelRyd6dGrEIQLaVV:O99tSzBoJK8nE4cUelRyd6dGrEIQLaP

Score

10^/10

blackmoon gh0strat banker persistence rat trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 9 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1620-57-0x0000000002DB0000-0x0000000002F5C000-memory.dmp	family_blackmoon
behavioral1/memory/1620-58-0x0000000002DB0000-0x0000000002F5C000-memory.dmp	family_blackmoon
behavioral1/memory/1620-59-0x0000000002DB0000-0x0000000002F5C000-memory.dmp	family_blackmoon
behavioral1/memory/1620-64-0x0000000001E70000-0x0000000001ED7000-memory.dmp	family_blackmoon
behavioral1/memory/1620-65-0x0000000001E70000-0x0000000001ED7000-memory.dmp	family_blackmoon
behavioral1/memory/1620-85-0x0000000001E70000-0x0000000001ED7000-memory.dmp	family_blackmoon
behavioral1/memory/1620-104-0x0000000001E70000-0x0000000001ED7000-memory.dmp	family_blackmoon
behavioral1/memory/1620-106-0x0000000001E70000-0x0000000001ED7000-memory.dmp	family_blackmoon
behavioral1/memory/1620-107-0x0000000002DB0000-0x0000000002F5C000-memory.dmp	family_blackmoon

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1620-92-0x0000000010000000-0x0000000010017000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Loads dropped DLL 2 IoCs

Processes:

9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe

pid	process
1620	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe
1620	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Windows\CurrentVersion\Run	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdatem = "C:\\Users\\Public\\Documents\\Applicationedwjl.exe"	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

2020 NOTEPAD.EXE

pid	process
2020	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe

pid	process
1620	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe
1620	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe
1620	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe
1620	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe
1620	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe
1620	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe
1620	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe
1620	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe

pid process

1620 9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe

description	pid	process
Token: 33	1620	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe
Token: SeIncBasePriorityPrivilege	1620	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe
Token: 33	1620	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe
Token: SeIncBasePriorityPrivilege	1620	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe

pid	process
1620	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe
1620	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe
1620	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe
1620	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe
1620	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe
1620	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe

pid process

1620 9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe

description	pid	process	target process
PID 1620 wrote to memory of 2020	1620	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe	NOTEPAD.EXE
PID 1620 wrote to memory of 2020	1620	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe	NOTEPAD.EXE
PID 1620 wrote to memory of 2020	1620	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe	NOTEPAD.EXE
PID 1620 wrote to memory of 2020	1620	9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe	NOTEPAD.EXE

C:\Users\Admin\AppData\Local\Temp\9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe
"C:\Users\Admin\AppData\Local\Temp\9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.txt
2⤵
- Opens file in notepad (likely ransom note)
PID:2020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9349a5bdadd179a52e12ade80f7dfb248dcbbb55d86552bcb622ca6b594bfba8.txt
Filesize
120KB

MD5
3aea5b78bac5359a799c2714fecccd1a

SHA1
5d3203b328ecfc7a55c0ded1032d209e9f273367

SHA256
c05e763cab67cf9daf5be7a6a6cff2650223987a9693eaa119f69b2bbb6df6c3

SHA512
9513cc84a7ed3dd709d4affb03f6e286dcd43e82f33441c00a9d74d2b45449f2ee20baa8db46218d7a59d9e62fb7f95050ea305166e70f3e71dde39ccf07b6d3

Download Submit
C:\Users\Public\Documents\sjsw.log
Filesize
248B

MD5
a165d57487dce60f7f618661c38bb9d9

SHA1
9f0f4061992256a99cf9f6a08be3238a5778f763

SHA256
ca3c0989272f5244d6200c673c6cd3440aa30f92b78d46e8f4382c8095e59499

SHA512
3b2d629e2f6d43bb5e1dd58bb7ca0ee3833734206a4d0c3c0955a9b5eb68a925486f23352bdc25066bb239ac2070d09699a241e2b5e83c29657c381db764d807

Download Submit
\Users\Admin\AppData\Local\Temp\jgty.dll
Filesize
2KB

MD5
7943effe67a4647e06def2348949020e

SHA1
eabd561f0639a975de259633f63896d82c3f878d

SHA256
3fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa

SHA512
c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003

Download Submit
\Users\Public\Documents\yhmb.dll
Filesize
2KB

MD5
7943effe67a4647e06def2348949020e

SHA1
eabd561f0639a975de259633f63896d82c3f878d

SHA256
3fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa

SHA512
c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003

Download Submit
memory/1620-86-0x0000000000370000-0x0000000000373000-memory.dmp

Filesize
12KB

Download
memory/1620-89-0x00000000049D0000-0x0000000004AC2000-memory.dmp

Filesize
968KB

Download
memory/1620-64-0x0000000001E70000-0x0000000001ED7000-memory.dmp

Filesize
412KB

Download
memory/1620-65-0x0000000001E70000-0x0000000001ED7000-memory.dmp

Filesize
412KB

Download
memory/1620-59-0x0000000002DB0000-0x0000000002F5C000-memory.dmp

Filesize
1.7MB

Download
memory/1620-58-0x0000000002DB0000-0x0000000002F5C000-memory.dmp

Filesize
1.7MB

Download
memory/1620-57-0x0000000002DB0000-0x0000000002F5C000-memory.dmp

Filesize
1.7MB

Download
memory/1620-85-0x0000000001E70000-0x0000000001ED7000-memory.dmp

Filesize
412KB

Download
memory/1620-88-0x00000000049D0000-0x0000000004AC2000-memory.dmp

Filesize
968KB

Download
memory/1620-60-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/1620-90-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1620-91-0x00000000049D0000-0x0000000004AC2000-memory.dmp

Filesize
968KB

Download
memory/1620-92-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/1620-95-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1620-104-0x0000000001E70000-0x0000000001ED7000-memory.dmp

Filesize
412KB

Download
memory/1620-106-0x0000000001E70000-0x0000000001ED7000-memory.dmp

Filesize
412KB

Download
memory/1620-107-0x0000000002DB0000-0x0000000002F5C000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads