blackmoon | 93d35c3a4af797bf6dbbafdc41ddef43ff3994f733519fe38fbd52d04df3ba35

Analysis

max time kernel
131s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2023 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93d35c3a4af797bf6dbbafdc41ddef43ff3994f733519fe38fbd52d04df3ba35.exe
Size

388KB
MD5

0957eaf2f20926b34b52c1bbb75357a8
SHA1

4aaff118476beebdd9660d37ab73d38ea8ab0af9
SHA256

93d35c3a4af797bf6dbbafdc41ddef43ff3994f733519fe38fbd52d04df3ba35
SHA512

e7f1345765831ca8c5963bf498b80c7293a25e2fb974fa6bc824a276110f2c14c5286993ee765a8b2eb99b2af3c0bc56447c56f497d8ad11ddcd43fe70d9aab4
SSDEEP

6144:KTu9kALUo0bF0sB7GHWAgV6fOfohGWaTQMIX1:2u9NIo38KHR0fofB1

Score

10^/10

blackmoon banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4572-159-0x0000000002620000-0x0000000002B9A000-memory.dmp	family_blackmoon
behavioral2/memory/4572-189-0x0000000002620000-0x0000000002B9A000-memory.dmp	family_blackmoon

Executes dropped EXE 2 IoCs

Processes:

netbri.exerepair.exe

pid process

4572 netbri.exe
4724 repair.exe
Loads dropped DLL 1 IoCs

Processes:

netbri.exe

pid process

4572 netbri.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

netbri.exerepair.exe

pid process

4572 netbri.exe
4572 netbri.exe
4572 netbri.exe
4724 repair.exe
4724 repair.exe
4572 netbri.exe

pid	process
4572	netbri.exe
4724	repair.exe

pid	process
4572	netbri.exe

pid	process
4572	netbri.exe
4572	netbri.exe
4572	netbri.exe
4724	repair.exe
4724	repair.exe
4572	netbri.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

93d35c3a4af797bf6dbbafdc41ddef43ff3994f733519fe38fbd52d04df3ba35.exe

description	pid	process	target process
PID 2192 wrote to memory of 4572	2192	93d35c3a4af797bf6dbbafdc41ddef43ff3994f733519fe38fbd52d04df3ba35.exe	netbri.exe
PID 2192 wrote to memory of 4572	2192	93d35c3a4af797bf6dbbafdc41ddef43ff3994f733519fe38fbd52d04df3ba35.exe	netbri.exe
PID 2192 wrote to memory of 4572	2192	93d35c3a4af797bf6dbbafdc41ddef43ff3994f733519fe38fbd52d04df3ba35.exe	netbri.exe
PID 2192 wrote to memory of 4724	2192	93d35c3a4af797bf6dbbafdc41ddef43ff3994f733519fe38fbd52d04df3ba35.exe	repair.exe
PID 2192 wrote to memory of 4724	2192	93d35c3a4af797bf6dbbafdc41ddef43ff3994f733519fe38fbd52d04df3ba35.exe	repair.exe
PID 2192 wrote to memory of 4724	2192	93d35c3a4af797bf6dbbafdc41ddef43ff3994f733519fe38fbd52d04df3ba35.exe	repair.exe

C:\Users\Admin\AppData\Local\Temp\93d35c3a4af797bf6dbbafdc41ddef43ff3994f733519fe38fbd52d04df3ba35.exe
"C:\Users\Admin\AppData\Local\Temp\93d35c3a4af797bf6dbbafdc41ddef43ff3994f733519fe38fbd52d04df3ba35.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Roaming\D1Softwaredata\netbri.exe
  C:\Users\Admin\AppData\Roaming\D1Softwaredata\netbri.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4572
- C:\Users\Admin\AppData\Roaming\D1Softwaredata\repair.exe
  C:\Users\Admin\AppData\Roaming\D1Softwaredata\repair.exe -Ho9LN
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DIFXAPI.zip

Filesize
13.5MB

MD5
19a6fd47024a2ca4df8cba7d2307d870

SHA1
57b96547faddbcfaa0cb0dc8cab8688c3f35a6e4

SHA256
3e8c1c993e89a90b9b7640b15579198e5aa3e2861327b2011b64385838ea82ec

SHA512
aa3d156a9a05146cca186be8338ddee5f72124b5901ff2c455c5ca7df5a64abe8c8c0a53874cbed8c84ec3bb9434e9f2c4d18beb708ed551c36afb4490dbef4d

Download Submit
C:\Users\Admin\AppData\Roaming\D1Softwaredata\Socket.dat

Filesize
2.1MB

MD5
6b2e2bf55cc794ac14062c9d6ae59766

SHA1
e9c0aedb68349dd03eef193c32245baa3c058712

SHA256
fd853123199c4fb92821b6255517226548452dffb12a95232271257308cdcac8

SHA512
49566af89e282ad3c4d3eb7c9dc45f0959df0e9539d74b8ffb0f2e8b9409528d6753f25c8cef5a9c4bbc203e00a2c7713f9d3f01d0de06a536cd602a6a386113

Download Submit
C:\Users\Admin\AppData\Roaming\D1Softwaredata\VCRUNTIME140.dll

Filesize
82KB

MD5
d0520569180accd7e17ed9697711d6ec

SHA1
46cb7e2db7efda70b9a5b75b2fe0bb6038499008

SHA256
13026df002b3575564f32927b7f791d59b4cc571f30ccc28075c4edb4afef67c

SHA512
86e96f5648d714914469a576693a656390291a547ea9dd5903c85853ac63c68f69129e54f95e5fc7aec781b883232ffaf0d5a536302226f4243d1f2e517e2034

Download Submit
C:\Users\Admin\AppData\Roaming\D1Softwaredata\display.ini

Filesize
128B

MD5
d4bd8bfcc44ef0e3afc4382b4d61140b

SHA1
af3344a3a12b85bc6b7a08e8d0b31d1f7010be43

SHA256
2cda7fbf3ee1e127f4be0b5bc092e7dcdeae7f670076485415f8dad45293458b

SHA512
32c807cfa8b8c5d2673ec9a3582fa6106e9936a8a793623751f994762496b5beeec0a6d95ee6388479b1a90775a807e8e8c41e08e3549efbb0bcf1c59e942b63

Download Submit
C:\Users\Admin\AppData\Roaming\D1Softwaredata\display.ini

Filesize
128B

MD5
d4bd8bfcc44ef0e3afc4382b4d61140b

SHA1
af3344a3a12b85bc6b7a08e8d0b31d1f7010be43

SHA256
2cda7fbf3ee1e127f4be0b5bc092e7dcdeae7f670076485415f8dad45293458b

SHA512
32c807cfa8b8c5d2673ec9a3582fa6106e9936a8a793623751f994762496b5beeec0a6d95ee6388479b1a90775a807e8e8c41e08e3549efbb0bcf1c59e942b63

Download Submit
C:\Users\Admin\AppData\Roaming\D1Softwaredata\netbri.exe

Filesize
700KB

MD5
a165e1db0ff449c3752a6959598d925f

SHA1
f122e6063f883bd071d4eb19527fdb39ffbd8033

SHA256
e3998468214b36f97454b9b8fb698cf8afa374522d7663ca979fcf7dd86e427e

SHA512
9b7839e3e56039b62c0c94c8bcbd00f5c92f9613c1a605a3226d38646991d763c09787618314647c9dad94d39323bb1827710aa6eff43f85bd20e2a700b50455

Download Submit
C:\Users\Admin\AppData\Roaming\D1Softwaredata\netbri.exe

Filesize
700KB

MD5
a165e1db0ff449c3752a6959598d925f

SHA1
f122e6063f883bd071d4eb19527fdb39ffbd8033

SHA256
e3998468214b36f97454b9b8fb698cf8afa374522d7663ca979fcf7dd86e427e

SHA512
9b7839e3e56039b62c0c94c8bcbd00f5c92f9613c1a605a3226d38646991d763c09787618314647c9dad94d39323bb1827710aa6eff43f85bd20e2a700b50455

Download Submit
C:\Users\Admin\AppData\Roaming\D1Softwaredata\plugins\qvlnk.dat

Filesize
5.3MB

MD5
49d86d9d0604a1cb441275a5d93d0d2a

SHA1
35294f4bfd5c4f74fe33836309f623a3c1f1ebcd

SHA256
56abe8a645c81029cc4cbea54bc6ae877663b45d148e520854d000faeec500f7

SHA512
a455f6b209e7a03be2ce7a17a4ffccc5609c589232522b1ea7cca557137848b94b32b35db4fc2838b81c74cd483a6faac24caf3366501f805d1b5cd676f32896

Download Submit
C:\Users\Admin\AppData\Roaming\D1Softwaredata\repair.exe

Filesize
792KB

MD5
0790e644e762bba5783bbd8a61aed38e

SHA1
92686f13e210c0d41530473199f70b3dc952e666

SHA256
66779c8d154621c2741fa2f1eefcb0bde4552a92fa2b9656d275b34a253e3dc5

SHA512
0c09e28f36f2695e556f524575cf8eede730fa27dc5eff49dfaddd3775ec9c8da070c948babf65a61f8265aec78a53e469d6bb0afdd33f4c8c902876e5a140c4

Download Submit
C:\Users\Admin\AppData\Roaming\D1Softwaredata\repair.exe

Filesize
792KB

MD5
0790e644e762bba5783bbd8a61aed38e

SHA1
92686f13e210c0d41530473199f70b3dc952e666

SHA256
66779c8d154621c2741fa2f1eefcb0bde4552a92fa2b9656d275b34a253e3dc5

SHA512
0c09e28f36f2695e556f524575cf8eede730fa27dc5eff49dfaddd3775ec9c8da070c948babf65a61f8265aec78a53e469d6bb0afdd33f4c8c902876e5a140c4

Download Submit
C:\Users\Admin\AppData\Roaming\D1Softwaredata\vcruntime140.dll

Filesize
82KB

MD5
d0520569180accd7e17ed9697711d6ec

SHA1
46cb7e2db7efda70b9a5b75b2fe0bb6038499008

SHA256
13026df002b3575564f32927b7f791d59b4cc571f30ccc28075c4edb4afef67c

SHA512
86e96f5648d714914469a576693a656390291a547ea9dd5903c85853ac63c68f69129e54f95e5fc7aec781b883232ffaf0d5a536302226f4243d1f2e517e2034

Download Submit
C:\Users\Admin\AppData\Roaming\D1Softwaredata\wgcore.dat

Filesize
1.3MB

MD5
9ba312854b464fc0b31a4af793715daa

SHA1
596b0a5d1747182037956375dd5403941e6f7d3c

SHA256
2142175d38852c480d600cce0e268633525cf73218a92254bbb150875cd2db1f

SHA512
09719cac4aceedc7fc103d709e85cb88a9e7bbea6d9c7bd4f682860636132da950267db1c77ea403f1997a5e3bb00b3b4ee7ce04068f6eec1f3bcfa0c16697fa

Download Submit
memory/4572-172-0x0000000003A10000-0x0000000003C32000-memory.dmp

Filesize
2.1MB

Download
memory/4572-179-0x0000000003A10000-0x0000000003C32000-memory.dmp

Filesize
2.1MB

Download
memory/4572-170-0x0000000003A10000-0x0000000003C32000-memory.dmp

Filesize
2.1MB

Download
memory/4572-171-0x0000000002D40000-0x0000000002E98000-memory.dmp

Filesize
1.3MB

Download
memory/4572-169-0x0000000002C50000-0x0000000002D40000-memory.dmp

Filesize
960KB

Download
memory/4572-174-0x0000000003A10000-0x0000000003C32000-memory.dmp

Filesize
2.1MB

Download
memory/4572-173-0x0000000003A10000-0x0000000003C32000-memory.dmp

Filesize
2.1MB

Download
memory/4572-176-0x0000000003A10000-0x0000000003C32000-memory.dmp

Filesize
2.1MB

Download
memory/4572-177-0x0000000003A10000-0x0000000003C32000-memory.dmp

Filesize
2.1MB

Download
memory/4572-178-0x0000000003A10000-0x0000000003C32000-memory.dmp

Filesize
2.1MB

Download
memory/4572-180-0x0000000003A10000-0x0000000003C32000-memory.dmp

Filesize
2.1MB

Download
memory/4572-161-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/4572-182-0x0000000003A10000-0x0000000003C32000-memory.dmp

Filesize
2.1MB

Download
memory/4572-175-0x0000000003A10000-0x0000000003C32000-memory.dmp

Filesize
2.1MB

Download
memory/4572-159-0x0000000002620000-0x0000000002B9A000-memory.dmp

Filesize
5.5MB

Download
memory/4572-158-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/4572-188-0x0000000006360000-0x0000000006387000-memory.dmp

Filesize
156KB

Download
memory/4572-187-0x00000000059D0000-0x0000000005ED5000-memory.dmp

Filesize
5.0MB

Download
memory/4572-189-0x0000000002620000-0x0000000002B9A000-memory.dmp

Filesize
5.5MB

Download
memory/4572-190-0x0000000002D40000-0x0000000002E98000-memory.dmp

Filesize
1.3MB

Download
memory/4572-191-0x0000000003A10000-0x0000000003C32000-memory.dmp

Filesize
2.1MB

Download
memory/4572-196-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download