blackmoon | 2ea3e072c2d78ce865f405b70490985bd2475f57320c588aeb504c2778579ce5

General

Target

JC_2ea3e072c2d78ce865f405b70490985bd2475f57320c588aeb504c2778579ce5.exe
Size

189KB
MD5

f4dd38add96e041efe1f84101843c2ff
SHA1

e2eaac1bf99a00679da28f10eb92379ebaadbf2b
SHA256

2ea3e072c2d78ce865f405b70490985bd2475f57320c588aeb504c2778579ce5
SHA512

645c3cd83b59af44e6344e8d6420b963cb7fe5b8da9f921ad1f9b2c5498d2d1d211abc4c6e0a60365399543109cfcc2f77a4372a9131e54d9ee63f21382584a2
SSDEEP

3072:OUcxp2iqKaW9ypLsjB8rgPNlC3nZ60qg65oIsulYljpapqgfOg0qG:OnaQY70oZ6Fg65Iuek3fR

Score

10^/10

blackmoon banker evasion trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral2/memory/4680-12-0x0000000000400000-0x00000000004AA000-memory.dmp	family_blackmoon

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1392	attrib.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4680	JC_2ea3e072c2d78ce865f405b70490985bd2475f57320c588aeb504c2778579ce5.exe
4680	JC_2ea3e072c2d78ce865f405b70490985bd2475f57320c588aeb504c2778579ce5.exe
4680	JC_2ea3e072c2d78ce865f405b70490985bd2475f57320c588aeb504c2778579ce5.exe
4680	JC_2ea3e072c2d78ce865f405b70490985bd2475f57320c588aeb504c2778579ce5.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4680	JC_2ea3e072c2d78ce865f405b70490985bd2475f57320c588aeb504c2778579ce5.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4680	JC_2ea3e072c2d78ce865f405b70490985bd2475f57320c588aeb504c2778579ce5.exe
Token: SeDebugPrivilege	4680	JC_2ea3e072c2d78ce865f405b70490985bd2475f57320c588aeb504c2778579ce5.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4680	JC_2ea3e072c2d78ce865f405b70490985bd2475f57320c588aeb504c2778579ce5.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 3720	4680	JC_2ea3e072c2d78ce865f405b70490985bd2475f57320c588aeb504c2778579ce5.exe	87
PID 4680 wrote to memory of 3720	4680	JC_2ea3e072c2d78ce865f405b70490985bd2475f57320c588aeb504c2778579ce5.exe	87
PID 4680 wrote to memory of 3720	4680	JC_2ea3e072c2d78ce865f405b70490985bd2475f57320c588aeb504c2778579ce5.exe	87
PID 3720 wrote to memory of 436	3720	cmd.exe	89
PID 3720 wrote to memory of 436	3720	cmd.exe	89
PID 3720 wrote to memory of 436	3720	cmd.exe	89
PID 3720 wrote to memory of 5032	3720	cmd.exe	91
PID 3720 wrote to memory of 5032	3720	cmd.exe	91
PID 3720 wrote to memory of 5032	3720	cmd.exe	91
PID 5032 wrote to memory of 668	5032	cmd.exe	92
PID 5032 wrote to memory of 668	5032	cmd.exe	92
PID 5032 wrote to memory of 668	5032	cmd.exe	92
PID 4680 wrote to memory of 3560	4680	JC_2ea3e072c2d78ce865f405b70490985bd2475f57320c588aeb504c2778579ce5.exe	93
PID 4680 wrote to memory of 3560	4680	JC_2ea3e072c2d78ce865f405b70490985bd2475f57320c588aeb504c2778579ce5.exe	93
PID 4680 wrote to memory of 3560	4680	JC_2ea3e072c2d78ce865f405b70490985bd2475f57320c588aeb504c2778579ce5.exe	93
PID 3560 wrote to memory of 1360	3560	cmd.exe	95
PID 3560 wrote to memory of 1360	3560	cmd.exe	95
PID 3560 wrote to memory of 1360	3560	cmd.exe	95
PID 3560 wrote to memory of 1392	3560	cmd.exe	96
PID 3560 wrote to memory of 1392	3560	cmd.exe	96
PID 3560 wrote to memory of 1392	3560	cmd.exe	96

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1392	attrib.exe

C:\Users\Admin\AppData\Local\Temp\JC_2ea3e072c2d78ce865f405b70490985bd2475f57320c588aeb504c2778579ce5.exe
"C:\Users\Admin\AppData\Local\Temp\JC_2ea3e072c2d78ce865f405b70490985bd2475f57320c588aeb504c2778579ce5.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\1122.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Windows\SysWOW64\mode.com
    mode con cols=15 lines=3
    3⤵
    PID:436
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c C:\Users\Admin\AppData\Local\Temp\1122.bat p
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5032
  - - C:\Windows\SysWOW64\mode.com
      mode con cols=15 lines=3
      4⤵
      PID:668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\1133.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Windows\SysWOW64\mode.com
    mode con cols=15 lines=3
    3⤵
    PID:1360
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +a +h +r "C:\test"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:1392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

2

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1122.bat

Filesize
197B

MD5
b4292e00eff53ec1da95e7225285e779

SHA1
695289b0ffaa5ee7b4084304c976045806687ddd

SHA256
dc4a1e18e67015e250c8bd71dcbce8d2234e73219b7dfcf8fd13d0733e4c2030

SHA512
00dc64420d7b8fda21873e4dfe9ec5fc0aec15a296385ca801641f6a8894692f6aeada71445ef54330f1acf4be6ab436e4ad99f24933e844baa6055efd02f1b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1133.bat

Filesize
146B

MD5
d61001211982ac769bbb185be1950976

SHA1
c856d74768d978bed799edfc07819fc28ba8f604

SHA256
03d8643c798c6d1f7c25e3dde6f9a3cb17015295456e099af2681b4ba7895b27

SHA512
7080a7d2c54d927960d42063eeea3514ada396c680108d3345660b69149daa446c38848f64138ec075cc7bc9c39112147fabda3fdd7826e763e1b6d1b87f23f1

Download Submit
memory/4680-0-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/4680-1-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/4680-2-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download
memory/4680-3-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/4680-10-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/4680-11-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download
memory/4680-12-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads