blackmoon | dea9294a69e0c35f866057c27f9177348454da02ac96eb0d2d4cfd671c8aee9c

Analysis

max time kernel
27s
max time network
32s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
09-07-2023 19:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dea9294a69e0c35f866057c27f9177348454da02ac96eb0d2d4cfd671c8aee9c.dll
Size

5.5MB
MD5

1426430c076a96028efb1be7b211a8f8
SHA1

71a417520e62e927db03543474e2f25d51a9e61f
SHA256

dea9294a69e0c35f866057c27f9177348454da02ac96eb0d2d4cfd671c8aee9c
SHA512

5c65ad28f1096799be7dd9e9f4be96ebca45cf9a6eb6d5ee7facd92f000e0d53c1ae04a37080b6d4d67464fb1a685149e1172180a4a2aca9da2efd69eb5e5232
SSDEEP

49152:wqqw3Ig3FovIOoGfYtsXo7Kq1Ixg28kRNQc6ugHLxfobOftajN5Q+/jsHG3jAy5/:xJ3Fov2Ga7AKBrAN56at6D

Score

10^/10

blackmoon banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 8 IoCs

Processes:

resource	yara_rule
behavioral1/memory/328-54-0x0000000002BB0000-0x0000000003143000-memory.dmp	family_blackmoon
behavioral1/memory/328-60-0x0000000002BB0000-0x0000000003143000-memory.dmp	family_blackmoon
behavioral1/memory/328-63-0x00000000009C0000-0x0000000000A91000-memory.dmp	family_blackmoon
\Windows\SysWOW64\libexdui.dll	family_blackmoon
behavioral1/memory/328-66-0x0000000002BB0000-0x0000000003143000-memory.dmp	family_blackmoon
behavioral1/memory/328-67-0x0000000002BB0000-0x0000000003143000-memory.dmp	family_blackmoon
behavioral1/memory/328-68-0x0000000002BB0000-0x0000000003143000-memory.dmp	family_blackmoon
behavioral1/memory/328-72-0x0000000002BB0000-0x0000000003143000-memory.dmp	family_blackmoon

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

1 328 rundll32.exe
Deletes itself 1 IoCs

Processes:

rundll32.exe

pid process

328 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

328 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\libexdui.dll rundll32.exe

flow	pid	process
1	328	rundll32.exe

pid	process
328	rundll32.exe

pid	process
328	rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\libexdui.dll	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore	rundll32.exe

Modifies registry class 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MUICACHE	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

328 rundll32.exe

pid	process
328	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3068 wrote to memory of 328	3068	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 328	3068	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 328	3068	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 328	3068	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 328	3068	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 328	3068	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 328	3068	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dea9294a69e0c35f866057c27f9177348454da02ac96eb0d2d4cfd671c8aee9c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dea9294a69e0c35f866057c27f9177348454da02ac96eb0d2d4cfd671c8aee9c.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Deletes itself
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\libexdui.dll

Filesize
760KB

MD5
f15e9d09aaa97a22fbe04fab5ce641df

SHA1
27ebfd9cd862a3d1bde4970ef2f62fcfa030e19f

SHA256
ddcdd62af5965c711f188fbfc9db532e0df344ec5d9955a5fbcb48899adba640

SHA512
a0ebf4c3d21a0dd07e4a87fd340be277bda7de3295ad3a2f156c091ec59054232b250b34cb8c1c3f85ba987a68a3a934dec73df2ddb061d3583dbf9ec358b005

Download Submit
memory/328-54-0x0000000002BB0000-0x0000000003143000-memory.dmp

Filesize
5.6MB

Download
memory/328-60-0x0000000002BB0000-0x0000000003143000-memory.dmp

Filesize
5.6MB

Download
memory/328-63-0x00000000009C0000-0x0000000000A91000-memory.dmp

Filesize
836KB

Download
memory/328-66-0x0000000002BB0000-0x0000000003143000-memory.dmp

Filesize
5.6MB

Download
memory/328-67-0x0000000002BB0000-0x0000000003143000-memory.dmp

Filesize
5.6MB

Download
memory/328-68-0x0000000002BB0000-0x0000000003143000-memory.dmp

Filesize
5.6MB

Download
memory/328-69-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/328-70-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/328-71-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/328-72-0x0000000002BB0000-0x0000000003143000-memory.dmp

Filesize
5.6MB

Download