blackmoon | a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace

Analysis

max time kernel
263s
max time network
316s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Size

15.4MB
MD5

2da8c4b8e832922633498af511147060
SHA1

3ca21cf5bd3f02a091ab7ad33b3e02a8639499a1
SHA256

a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace
SHA512

6ab904584c275406c96855536568cc2dff80a902a8d96d646e766f2bfdae5226d213b0a77a62a30c3f614111042e70d385fcf53ab7dc3a3033a46cd92542b06e
SSDEEP

393216:rp8kJfML4vyJpSYTp5Ijhpe16uqB2fqgQyvKmmWTBB:r2CDyLTEVrucmqhRWTj

Score

10^/10

blackmoon banker trojan vmprotect

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 3 IoCs

resource	yara_rule
behavioral1/memory/2912-4-0x0000000000400000-0x00000000023B6000-memory.dmp	family_blackmoon
behavioral1/memory/2912-10-0x0000000000400000-0x00000000023B6000-memory.dmp	family_blackmoon
behavioral1/memory/2912-54-0x0000000000400000-0x00000000023B6000-memory.dmp	family_blackmoon

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2912-4-0x0000000000400000-0x00000000023B6000-memory.dmp	vmprotect
behavioral1/memory/2912-10-0x0000000000400000-0x00000000023B6000-memory.dmp	vmprotect
behavioral1/memory/2912-54-0x0000000000400000-0x00000000023B6000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TypedURLs	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: 1	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeCreateTokenPrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeAssignPrimaryTokenPrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeLockMemoryPrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeIncreaseQuotaPrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeMachineAccountPrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeTcbPrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeSecurityPrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeTakeOwnershipPrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeLoadDriverPrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeSystemProfilePrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeSystemtimePrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeProfSingleProcessPrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeIncBasePriorityPrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeCreatePagefilePrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeCreatePermanentPrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeBackupPrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeRestorePrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeShutdownPrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeDebugPrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeAuditPrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeSystemEnvironmentPrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeChangeNotifyPrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeRemoteShutdownPrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeUndockPrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeSyncAgentPrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeEnableDelegationPrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeManageVolumePrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeImpersonatePrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: SeCreateGlobalPrivilege	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: 31	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: 32	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: 33	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: 34	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: 35	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: 36	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: 37	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: 38	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: 39	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: 40	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: 41	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: 42	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: 43	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: 44	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: 45	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: 46	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: 47	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
Token: 48	2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
2912	a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe

C:\Users\Admin\AppData\Local\Temp\a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe
"C:\Users\Admin\AppData\Local\Temp\a4aead48c90df3cae46ea45e909ad6d8ebc87ccc75455e6b07e7302624711ace.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2912-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2912-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2912-4-0x0000000000400000-0x00000000023B6000-memory.dmp

Filesize
31.7MB

Download
memory/2912-5-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2912-6-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2912-8-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2912-11-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2912-10-0x0000000000400000-0x00000000023B6000-memory.dmp

Filesize
31.7MB

Download
memory/2912-14-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2912-16-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2912-19-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2912-21-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2912-24-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2912-26-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2912-29-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2912-31-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2912-32-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2912-34-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2912-36-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2912-38-0x0000000077B90000-0x0000000077B91000-memory.dmp

Filesize
4KB

Download
memory/2912-37-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2912-40-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2912-42-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2912-52-0x0000000010000000-0x000000001003C000-memory.dmp

Filesize
240KB

Download
memory/2912-53-0x00000000051A0000-0x00000000052A1000-memory.dmp

Filesize
1.0MB

Download
memory/2912-54-0x0000000000400000-0x00000000023B6000-memory.dmp

Filesize
31.7MB

Download