blackmoon | ed04378d4fe8fd0814a4435d86b7097706413094c476b29f2539b08ae9592bc2

Analysis

max time kernel
114s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2023 07:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed04378d4fe8fd0814a4435d8.exe
Size

1.8MB
MD5

4b24bb7eb024e319888f9e7e00fe4243
SHA1

c3607f61d72e6ec43cf7bf4f41d166eecaa27f58
SHA256

ed04378d4fe8fd0814a4435d86b7097706413094c476b29f2539b08ae9592bc2
SHA512

48c27f416e07307ee046ccab04fe868b0cf25fe178b002bcc1075adbc47d3fb7ae92b0e8709cdbd159f54755bd7c492e343d8da149d2a9a227836a8d315a0fc3
SSDEEP

49152:iRTQWltDVTODlosbWp6FjTxEeliYZ8+Y7JKQa:itzlnY/bW0FjTOKZJaJI

Score

10^/10

blackmoon banker evasion trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Public\xiaodaxzqxia\jecxz.exe	family_blackmoon
C:\Users\Public\xiaodaxzqxia\jecxz.exe	family_blackmoon

UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

reg.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe
Downloads MZ/PE file

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ed04378d4fe8fd0814a4435d8.exeWScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-508929744-1894537824-211734425-1000\Control Panel\International\Geo\Nation	ed04378d4fe8fd0814a4435d8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-508929744-1894537824-211734425-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 2 IoCs

Processes:

jecxz.exev.exe

pid process

4948 jecxz.exe
2756 v.exe
Loads dropped DLL 1 IoCs

Processes:

v.exe

pid process

2756 v.exe

pid	process
4948	jecxz.exe
2756	v.exe

pid	process
2756	v.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/228-133-0x0000000000400000-0x000000000083F000-memory.dmp	upx
behavioral2/memory/228-152-0x0000000000400000-0x000000000083F000-memory.dmp	upx
behavioral2/memory/228-184-0x0000000000400000-0x000000000083F000-memory.dmp	upx
behavioral2/memory/228-185-0x0000000000400000-0x000000000083F000-memory.dmp	upx

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

jecxz.exe

description	ioc	process
File opened (read-only)	\??\I:	jecxz.exe
File opened (read-only)	\??\K:	jecxz.exe
File opened (read-only)	\??\S:	jecxz.exe
File opened (read-only)	\??\X:	jecxz.exe
File opened (read-only)	\??\Z:	jecxz.exe
File opened (read-only)	\??\H:	jecxz.exe
File opened (read-only)	\??\M:	jecxz.exe
File opened (read-only)	\??\O:	jecxz.exe
File opened (read-only)	\??\P:	jecxz.exe
File opened (read-only)	\??\Q:	jecxz.exe
File opened (read-only)	\??\T:	jecxz.exe
File opened (read-only)	\??\U:	jecxz.exe
File opened (read-only)	\??\W:	jecxz.exe
File opened (read-only)	\??\B:	jecxz.exe
File opened (read-only)	\??\E:	jecxz.exe
File opened (read-only)	\??\G:	jecxz.exe
File opened (read-only)	\??\J:	jecxz.exe
File opened (read-only)	\??\R:	jecxz.exe
File opened (read-only)	\??\Y:	jecxz.exe
File opened (read-only)	\??\L:	jecxz.exe
File opened (read-only)	\??\N:	jecxz.exe
File opened (read-only)	\??\V:	jecxz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

jecxz.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	jecxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	jecxz.exe

Modifies registry class 1 IoCs

Processes:

ed04378d4fe8fd0814a4435d8.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-508929744-1894537824-211734425-1000_Classes\Local Settings ed04378d4fe8fd0814a4435d8.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

4472 reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-508929744-1894537824-211734425-1000_Classes\Local Settings	ed04378d4fe8fd0814a4435d8.exe

pid	process
4472	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ed04378d4fe8fd0814a4435d8.exejecxz.exe

pid	process
228	ed04378d4fe8fd0814a4435d8.exe
228	ed04378d4fe8fd0814a4435d8.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe
4948	jecxz.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

v.exe

description pid process

Token: SeRestorePrivilege 2756 v.exe
Token: 35 2756 v.exe
Token: SeSecurityPrivilege 2756 v.exe
Token: SeSecurityPrivilege 2756 v.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

ed04378d4fe8fd0814a4435d8.exejecxz.exehh.exehh.exe

pid process

228 ed04378d4fe8fd0814a4435d8.exe
228 ed04378d4fe8fd0814a4435d8.exe
4948 jecxz.exe
4948 jecxz.exe
4024 hh.exe
4024 hh.exe
808 hh.exe
808 hh.exe

description	pid	process
Token: SeRestorePrivilege	2756	v.exe
Token: 35	2756	v.exe
Token: SeSecurityPrivilege	2756	v.exe
Token: SeSecurityPrivilege	2756	v.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

ed04378d4fe8fd0814a4435d8.execmd.exeWScript.execmd.execmd.execmd.exe

description	pid	process	target process
PID 228 wrote to memory of 2908	228	ed04378d4fe8fd0814a4435d8.exe	cmd.exe
PID 228 wrote to memory of 2908	228	ed04378d4fe8fd0814a4435d8.exe	cmd.exe
PID 228 wrote to memory of 2908	228	ed04378d4fe8fd0814a4435d8.exe	cmd.exe
PID 2908 wrote to memory of 4196	2908	cmd.exe	reg.exe
PID 2908 wrote to memory of 4196	2908	cmd.exe	reg.exe
PID 2908 wrote to memory of 4196	2908	cmd.exe	reg.exe
PID 228 wrote to memory of 3104	228	ed04378d4fe8fd0814a4435d8.exe	WScript.exe
PID 228 wrote to memory of 3104	228	ed04378d4fe8fd0814a4435d8.exe	WScript.exe
PID 228 wrote to memory of 3104	228	ed04378d4fe8fd0814a4435d8.exe	WScript.exe
PID 3104 wrote to memory of 1564	3104	WScript.exe	cmd.exe
PID 3104 wrote to memory of 1564	3104	WScript.exe	cmd.exe
PID 3104 wrote to memory of 1564	3104	WScript.exe	cmd.exe
PID 1564 wrote to memory of 4064	1564	cmd.exe	reg.exe
PID 1564 wrote to memory of 4064	1564	cmd.exe	reg.exe
PID 1564 wrote to memory of 4064	1564	cmd.exe	reg.exe
PID 228 wrote to memory of 2756	228	ed04378d4fe8fd0814a4435d8.exe	v.exe
PID 228 wrote to memory of 2756	228	ed04378d4fe8fd0814a4435d8.exe	v.exe
PID 228 wrote to memory of 2756	228	ed04378d4fe8fd0814a4435d8.exe	v.exe
PID 228 wrote to memory of 1424	228	ed04378d4fe8fd0814a4435d8.exe	cmd.exe
PID 228 wrote to memory of 1424	228	ed04378d4fe8fd0814a4435d8.exe	cmd.exe
PID 228 wrote to memory of 1424	228	ed04378d4fe8fd0814a4435d8.exe	cmd.exe
PID 1424 wrote to memory of 2340	1424	cmd.exe	cmd.exe
PID 1424 wrote to memory of 2340	1424	cmd.exe	cmd.exe
PID 1424 wrote to memory of 2340	1424	cmd.exe	cmd.exe
PID 2340 wrote to memory of 4472	2340	cmd.exe	reg.exe
PID 2340 wrote to memory of 4472	2340	cmd.exe	reg.exe
PID 2340 wrote to memory of 4472	2340	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\ed04378d4fe8fd0814a4435d8.exe
"C:\Users\Admin\AppData\Local\Temp\ed04378d4fe8fd0814a4435d8.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Public\xiaodaxzqxia\n.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0" /v "1201" /d "0" /t REG_DWORD /f
    3⤵
    PID:4196
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Public\xiaodaxzqxia\A.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Public\xiaodaxzqxia\n.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1564
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0" /v "1201" /d "0" /t REG_DWORD /f
      4⤵
      PID:4064
- C:\Users\Public\xiaodaxzqxia\v.exe
  "C:\Users\Public\xiaodaxzqxia\v.exe" x 111 -y
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:2756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Public\xiaodaxzqxia\v.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /k C:\Windows\System32\reg.exe add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:4472

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3208

C:\Users\Public\xiaodaxzqxia\jecxz.exe
"C:\Users\Public\xiaodaxzqxia\jecxz.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4948

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Public\cxzvasdfg\2919001220530604\A11.chm
1⤵
- Suspicious use of SetWindowsHookEx
PID:4024

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Public\cxzvasdfg\2919001220530604\A11.chm
1⤵
- Suspicious use of SetWindowsHookEx
PID:808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\HTML Help\hh.dat

Filesize
8KB

MD5
57490d63002c5b24cdb22a044d7c18aa

SHA1
3fd2deed98ceda244a0c8428cebc269baae5597c

SHA256
57c2e2d376a64ec7b9d6be1edb1432c99fa579e2d8bf34e33ebe8c1596de84dd

SHA512
d3986a26e0b313f5854645a1ff21792c336aa2dc4d84a48781505e98035f6137a3f63f459728e7d9320f96ac997f39d1adbe36dc25047be5414c7e302606998d

Download Submit
C:\Users\Public\cxzvasdfg\2919001220530604\A11.chm

Filesize
9KB

MD5
2342b3ba19855ddd8c3e311b2842bdbb

SHA1
ecec63f62d445bdcc369af3f29df566611c7d4a5

SHA256
257c340891c8007dbb720853244785b8d7433fb70ca0038528b9fde035d0bfe6

SHA512
f5230c860656004d8f860f5b2941b15519cebf7ce6494eefcea6307be4057f5cd6178cbdfca9a022d28fd11cc0d81ed1f2a719ff9a614e28a0eb12f048302cb9

Download Submit
C:\Users\Public\xiaodaxzqxia\1

Filesize
291KB

MD5
66bbcc42fe6cf9c1b890ec4a9049a9d7

SHA1
dd6bf3e2ca01625a1c2d1cd59ec523b55978d32e

SHA256
4950e959cb8ac30540acf2544bbe6a0bdf78e7ea2ce558f248c7f902df29b9ae

SHA512
56daaa94dab1ec09d3a328f78e794d6040822ef26ee5370020e59a9da0e0be7e7c95c4e1805d24cf9270a475219e4dd98aa3a71afc6785df406f99a17110ddb0

Download Submit
C:\Users\Public\xiaodaxzqxia\111

Filesize
1.1MB

MD5
b6672f5964eb4f8495ac54286af46c2c

SHA1
cc41541c3dfec64af741154dddf28a0a5b0c7876

SHA256
2b5fb8e16196b2c9f79406b5266de3f5a0709d7522e40f82f411df91e5d9b6b3

SHA512
fb0a0cf37fcb88e647ff444eb3b7fd4445ebad38726172d91f26bb8ec41998e655a2ab27e4e7abba4b628bb694d07d5197311368de59e7b67309ae605468e0e6

Download Submit
C:\Users\Public\xiaodaxzqxia\7z.dll

Filesize
1.2MB

MD5
a65e53c974a4e61728ecb632339a0978

SHA1
27e6ec4f8e34b40f1e08503245700c182b918ce9

SHA256
ca8ab5aeef734f24a3c58bf10b3f0152c2ea1329b02d2730448693df563b4c6a

SHA512
b029962f08867496cd3fd5e9af4b0703dae918e938aee759aeffbb4184ea6d3e81e0878ba8957e80d30db5d7b6fc8598e68918a4d16b3d010f31a2e16417593e

Download Submit
C:\Users\Public\xiaodaxzqxia\7z.dll

Filesize
1.2MB

MD5
a65e53c974a4e61728ecb632339a0978

SHA1
27e6ec4f8e34b40f1e08503245700c182b918ce9

SHA256
ca8ab5aeef734f24a3c58bf10b3f0152c2ea1329b02d2730448693df563b4c6a

SHA512
b029962f08867496cd3fd5e9af4b0703dae918e938aee759aeffbb4184ea6d3e81e0878ba8957e80d30db5d7b6fc8598e68918a4d16b3d010f31a2e16417593e

Download Submit
C:\Users\Public\xiaodaxzqxia\A.vbs

Filesize
107B

MD5
bcb223ea9c0598f04684216bcd0e12a6

SHA1
2661c8fbca3654a29fa261def7f16ea23a6f3165

SHA256
ef2113720c94cbe4cb494d6e24d26803b4b1a094e35e4285cd4a2f5665ef2c37

SHA512
77e440462544ca9f711f9241096601060080f5751651cab8a796d57ed74c424f03a9237a653c17a386c1ef654e6192d0e54080632dacff15a28a46564e639682

Download Submit
C:\Users\Public\xiaodaxzqxia\jecxz.exe

Filesize
124KB

MD5
0ae1550ae663898ee1aaab5438cf1098

SHA1
2f34e17397c083f7f6a5972fc989bf5f603a4996

SHA256
30690ccaa855ed9b1eb767045e4731cf828746e00c40b386770ced5e8ccf514c

SHA512
48ce7af1c7aed2a884a185715f4f131bbf7a7514da095b109bd087d5e70ec3db01d59ac4cb380f7efdc8d41ee23a8921b6aba31c85772ca16965970eb80ccd2c

Download Submit
C:\Users\Public\xiaodaxzqxia\jecxz.exe

Filesize
124KB

MD5
0ae1550ae663898ee1aaab5438cf1098

SHA1
2f34e17397c083f7f6a5972fc989bf5f603a4996

SHA256
30690ccaa855ed9b1eb767045e4731cf828746e00c40b386770ced5e8ccf514c

SHA512
48ce7af1c7aed2a884a185715f4f131bbf7a7514da095b109bd087d5e70ec3db01d59ac4cb380f7efdc8d41ee23a8921b6aba31c85772ca16965970eb80ccd2c

Download Submit
C:\Users\Public\xiaodaxzqxia\n.bat

Filesize
263B

MD5
c7d8b33e05722104d63de564a5d92b01

SHA1
fd703f1c71ac1dae65dc34f3521854604cec8091

SHA256
538ce88a3eed5a98c6a021a4c541080c5cfb652962f37da620e35b537513317a

SHA512
54a80fc6ad3f08743dc1655c379de79f9496086a9a18f4716fc9a9d6a6fe4fd527dd4ac099c57408090b73903c64fa38d4723783708068878aa6e18c6cc0d08e

Download Submit
C:\Users\Public\xiaodaxzqxia\v.bat

Filesize
275B

MD5
be7bbc9c7f6b505918f84b006b871965

SHA1
62f62090deb64ebdd93e2d48a1b85b3d0082415b

SHA256
259d09385d3e18e569e36542ea92eee43747ec48244659ca21ff6e20e9a9d91d

SHA512
84afc35227b5b590b5db0bb0e3c1c991202c0d6eef6ecc3ec9d7c097dce3e60d32c85915c7103efa413586a62e0ee7ae773fe13186a2f37825d1f20ac3f705e9

Download Submit
C:\Users\Public\xiaodaxzqxia\v.exe

Filesize
329KB

MD5
62d2156e3ca8387964f7aa13dd1ccd5b

SHA1
a5067e046ed9ea5512c94d1d17c394d6cf89ccca

SHA256
59cbfba941d3ac0238219daa11c93969489b40f1e8b38fabdb5805ac3dd72bfa

SHA512
006f7c46021f339b6cbf9f0b80cffa74abb8d48e12986266d069738c4e6bdb799bfba4b8ee4565a01e90dbe679a96a2399d795a6ead6eacbb4818a155858bf60

Download Submit
memory/228-152-0x0000000000400000-0x000000000083F000-memory.dmp

Filesize
4.2MB

Download
memory/228-133-0x0000000000400000-0x000000000083F000-memory.dmp

Filesize
4.2MB

Download
memory/228-184-0x0000000000400000-0x000000000083F000-memory.dmp

Filesize
4.2MB

Download
memory/228-185-0x0000000000400000-0x000000000083F000-memory.dmp

Filesize
4.2MB

Download
memory/4948-151-0x0000000002170000-0x00000000021BA000-memory.dmp

Filesize
296KB

Download
memory/4948-150-0x0000000002170000-0x00000000021BA000-memory.dmp

Filesize
296KB

Download
memory/4948-175-0x0000000002170000-0x00000000021BA000-memory.dmp

Filesize
296KB

Download
memory/4948-149-0x0000000002170000-0x00000000021BA000-memory.dmp

Filesize
296KB

Download
memory/4948-147-0x0000000002170000-0x00000000021BA000-memory.dmp

Filesize
296KB

Download