blackmoon | cd1d744dc39adf50bc17b587d203d5fce77995c4c51cc0438187dfc9eabbd948

General

Target

py-hzz.msi
Size

118.5MB
MD5

647864bf491144519120e6aef0ccee2b
SHA1

aa0f4f5ae485cc31c80d1241442bd07710db353e
SHA256

1e87ebcf8bf36d40079573ee61efb7f4e7f70b46c85ca1888899490b4be5f98d
SHA512

12bdbed6a35d0c22e3266f1356ad8261d66d539be4e344084aeb7a3d05d438081ffd328ba6da9028f745b17e50af96b27e80ebc7cec2969acda308657c7019c1
SSDEEP

3145728:n92fD6MoAr3Z1q3oeZJDN/Mfm1eoT1Fl0f5yQBtmpX4:gfD6Moc3a3oeZnMGBRsdtmR

Score

10^/10

blackmoon banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
\Users\Public\Videos\study59\2.dll	family_blackmoon

Executes dropped EXE 1 IoCs

Processes:

QuickQ.exe

pid process

2464 QuickQ.exe
Loads dropped DLL 2 IoCs

Processes:

QuickQ.exe

pid process

2464 QuickQ.exe
2464 QuickQ.exe

pid	process
2464	QuickQ.exe

pid	process
2464	QuickQ.exe
2464	QuickQ.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Drops file in Program Files directory 2 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\搜狗输入法\搜狗输入法\QuickQ.exe	msiexec.exe
File created	C:\Program Files (x86)\搜狗输入法\搜狗输入法\1.exe	msiexec.exe

Drops file in Windows directory 8 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIC8AC.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f77c40a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f77c40a.msi	msiexec.exe
File created	C:\Windows\Installer\f77c40b.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

1672 msiexec.exe
1672 msiexec.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msiexec.exe

pid process

2300 msiexec.exe

pid	process
1672	msiexec.exe
1672	msiexec.exe

pid	process
2300	msiexec.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	2300	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	1672	msiexec.exe
Token: SeTakeOwnershipPrivilege	1672	msiexec.exe
Token: SeSecurityPrivilege	1672	msiexec.exe
Token: SeCreateTokenPrivilege	2300	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2300	msiexec.exe
Token: SeLockMemoryPrivilege	2300	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2300	msiexec.exe
Token: SeMachineAccountPrivilege	2300	msiexec.exe
Token: SeTcbPrivilege	2300	msiexec.exe
Token: SeSecurityPrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeLoadDriverPrivilege	2300	msiexec.exe
Token: SeSystemProfilePrivilege	2300	msiexec.exe
Token: SeSystemtimePrivilege	2300	msiexec.exe
Token: SeProfSingleProcessPrivilege	2300	msiexec.exe
Token: SeIncBasePriorityPrivilege	2300	msiexec.exe
Token: SeCreatePagefilePrivilege	2300	msiexec.exe
Token: SeCreatePermanentPrivilege	2300	msiexec.exe
Token: SeBackupPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeShutdownPrivilege	2300	msiexec.exe
Token: SeDebugPrivilege	2300	msiexec.exe
Token: SeAuditPrivilege	2300	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2300	msiexec.exe
Token: SeChangeNotifyPrivilege	2300	msiexec.exe
Token: SeRemoteShutdownPrivilege	2300	msiexec.exe
Token: SeUndockPrivilege	2300	msiexec.exe
Token: SeSyncAgentPrivilege	2300	msiexec.exe
Token: SeEnableDelegationPrivilege	2300	msiexec.exe
Token: SeManageVolumePrivilege	2300	msiexec.exe
Token: SeImpersonatePrivilege	2300	msiexec.exe
Token: SeCreateGlobalPrivilege	2300	msiexec.exe
Token: SeBackupPrivilege	2800	vssvc.exe
Token: SeRestorePrivilege	2800	vssvc.exe
Token: SeAuditPrivilege	2800	vssvc.exe
Token: SeBackupPrivilege	1672	msiexec.exe
Token: SeRestorePrivilege	1672	msiexec.exe
Token: SeRestorePrivilege	2576	DrvInst.exe
Token: SeRestorePrivilege	2576	DrvInst.exe
Token: SeRestorePrivilege	2576	DrvInst.exe
Token: SeRestorePrivilege	2576	DrvInst.exe
Token: SeRestorePrivilege	2576	DrvInst.exe
Token: SeRestorePrivilege	2576	DrvInst.exe
Token: SeRestorePrivilege	2576	DrvInst.exe
Token: SeLoadDriverPrivilege	2576	DrvInst.exe
Token: SeLoadDriverPrivilege	2576	DrvInst.exe
Token: SeLoadDriverPrivilege	2576	DrvInst.exe
Token: SeRestorePrivilege	1672	msiexec.exe
Token: SeTakeOwnershipPrivilege	1672	msiexec.exe
Token: SeRestorePrivilege	1672	msiexec.exe
Token: SeTakeOwnershipPrivilege	1672	msiexec.exe
Token: SeRestorePrivilege	1672	msiexec.exe
Token: SeTakeOwnershipPrivilege	1672	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msiexec.exe

pid process

2300 msiexec.exe

pid	process
2300	msiexec.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 1672 wrote to memory of 2464	1672	msiexec.exe	QuickQ.exe
PID 1672 wrote to memory of 2464	1672	msiexec.exe	QuickQ.exe
PID 1672 wrote to memory of 2464	1672	msiexec.exe	QuickQ.exe
PID 1672 wrote to memory of 2464	1672	msiexec.exe	QuickQ.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\py-hzz.msi
1⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2300

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672

C:\Program Files (x86)\搜狗输入法\搜狗输入法\QuickQ.exe
"C:\Program Files (x86)\搜狗输入法\搜狗输入法\QuickQ.exe" /Install
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2800

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005BC" "00000000000004A0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\搜狗输入法\搜狗输入法\QuickQ.exe

Filesize
3.0MB

MD5
1e1b42b6c885280e082ac373f7b59f3f

SHA1
1e6646b827f5089aefedac669f62ef55a19d7ad2

SHA256
14b6a49fb11961fb851c51b3dbca5ee8cb02d86e5dfcf7cdbd9edcd06f2c118c

SHA512
56826f422d8f68d6c9a6b7cd23c0a48fa7ee48c4e90588f630d4b08588b63e8cfff230549272d8411cd2fe229f158ddc108a48cba658064ded4e76e0d9064c64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JXO65VIN\BGDNQG38.htm

Filesize
399KB

MD5
7465dec6024accd6657347c43d7e4146

SHA1
8f9eef39e9815cb02c0e0d41c63afa06c8dd411a

SHA256
319b1191e1f4ea8a6e633db14736306b946714f7dc200cbb217804388d4e176f

SHA512
4ca505db71406a882eadf5b76dfb96dc04782935f090f90d3ca12402dd5f35d8aff77f9a61eae7f9eb78695443afd918ba8b6fa7b2db199a7b478d3c64f5bdac

Download Submit
\Users\Public\Videos\study59\1.dll

Filesize
1.9MB

MD5
efb4f7f2c29f4b812ec344782c751ead

SHA1
84e6ec5323d1c535dcf4c7bbdde259a9847eee39

SHA256
d48fb613b4336547f5925f88ffd5de78bb36974634aad096deeb5af4be1b96c6

SHA512
dc85c2005c84da617bf2280471db7afb4e4bb3f85aa885136b6daf14041ee6d0dd4afd043ac1d16e4b14eddc05ad93aa8e2dec55d1e8e22e05427666cfb2c4c4

Download Submit
\Users\Public\Videos\study59\2.dll

Filesize
576KB

MD5
e1b3cf30274e632c35be299d4d6e3931

SHA1
9c52dccc089995899c566d1897d4b6e623c790b6

SHA256
37987d399b9d543125909768f6197783fe8ea92d2575622ae3df9e396444f6fd

SHA512
1b9475c430d70cd18097849d5eecd1d41493811f7162ca89cc29ce87093b7261e9c594567d9b39cf49157e6feb50f0f014ca93d5923fe124bafe9504db976443

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads