blackmoon | fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80

General

Target

fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
Size

11.1MB
MD5

66060796a135bcc256f569cf71b8d7b3
SHA1

bf25e18d3335a33d67a5dddce4098cac157016af
SHA256

fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80
SHA512

ab19854de6f4b225ee54be26585022e6ddc479d8570674bdc359ff6c3912ece3c0e436418c7bb7d447845e623d16f8079f38879ab06d3da7a057b1b6c39b1301
SSDEEP

196608:/YTjeJt8IgpScDtpVpyINxBrw0EiYvfhxPe4fXicIM4FFM8bWKD/e4LpSXpfE85L:uWt8I0ppTvBMIYVPeikq4LpWcUmM

Score

10^/10

blackmoon banker trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 3 IoCs

resource	yara_rule
behavioral2/memory/4440-12-0x0000000001810000-0x0000000001928000-memory.dmp	family_blackmoon
behavioral2/memory/4440-14-0x00000000038A0000-0x00000000039CC000-memory.dmp	family_blackmoon
behavioral2/memory/4440-28-0x00000000038A0000-0x00000000039CC000-memory.dmp	family_blackmoon

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4440-17-0x0000000000400000-0x0000000000F23040-memory.dmp	upx
behavioral2/memory/4440-11-0x0000000000400000-0x0000000000F23040-memory.dmp	upx
behavioral2/memory/4440-19-0x0000000000400000-0x0000000000F23040-memory.dmp	upx
behavioral2/memory/4440-21-0x0000000000400000-0x0000000000F23040-memory.dmp	upx
behavioral2/memory/4440-27-0x0000000000400000-0x0000000000F23040-memory.dmp	upx

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
File opened (read-only)	\??\O:	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
File opened (read-only)	\??\P:	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
File opened (read-only)	\??\W:	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
File opened (read-only)	\??\X:	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
File opened (read-only)	\??\Y:	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
File opened (read-only)	\??\E:	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
File opened (read-only)	\??\H:	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
File opened (read-only)	\??\J:	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
File opened (read-only)	\??\S:	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
File opened (read-only)	\??\U:	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
File opened (read-only)	\??\V:	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
File opened (read-only)	\??\Z:	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
File opened (read-only)	\??\G:	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
File opened (read-only)	\??\K:	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
File opened (read-only)	\??\L:	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
File opened (read-only)	\??\Q:	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
File opened (read-only)	\??\M:	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
File opened (read-only)	\??\N:	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
File opened (read-only)	\??\R:	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
File opened (read-only)	\??\T:	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4440	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4816	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
4816	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 4440	4816	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe	88
PID 4816 wrote to memory of 4440	4816	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe	88
PID 4816 wrote to memory of 4440	4816	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe	88
PID 4816 wrote to memory of 4440	4816	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe	88
PID 4816 wrote to memory of 4440	4816	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe	88
PID 4816 wrote to memory of 4440	4816	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe	88
PID 4816 wrote to memory of 4440	4816	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe	88
PID 4816 wrote to memory of 4440	4816	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe	88
PID 4816 wrote to memory of 4440	4816	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe	88
PID 4816 wrote to memory of 4440	4816	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe	88
PID 4816 wrote to memory of 4440	4816	fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe	88

C:\Users\Admin\AppData\Local\Temp\fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
"C:\Users\Admin\AppData\Local\Temp\fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Users\Admin\AppData\Local\Temp\fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
  C:\Users\Admin\AppData\Local\Temp\fe6eb9acbcba7ba21ce557f33a4900f14eb2e692039ace94bcad0c9ef5cf2f80.exe
  2⤵
  - Enumerates connected drives
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\luls.pk

Filesize
4.4MB

MD5
e85716eb2fb2587c45b46c4aaac5636b

SHA1
43cb8934ce5aa275f0644533030f2f5db24b57ab

SHA256
421147720f4897db9fbd9216f62f7e2bcc7c4c8c0eb89e0c274a71b149606d15

SHA512
04d4002fc8664396499df79b7de785dc62e3362e03cfdef9bef9c0179ffd382d7d1815d2555d214a4d544d3b8643594be8076a893c12857a8a3465fc6ca36098

Download Submit
C:\Users\Admin\AppData\Local\Temp\temps.temp

Filesize
3.5MB

MD5
142a46a7585fc54b4ac46c43a0645bd2

SHA1
ff64ba0726cdd038f57b84a18e656640106b7887

SHA256
5ac74c3b17ba519f9f59355aa854b529f6c046bee53859dbbf8a60d772827101

SHA512
1275c9f0b7c2b2f35a915b4347625550bce0526d3e43134a9b97f7ae4b0e4de70d0415301d988c6a1440d39ef2baeaaf0741b613b5ca599255598d0ae6e4341a

Download Submit
memory/4440-17-0x0000000000400000-0x0000000000F23040-memory.dmp

Filesize
11.1MB

Download
memory/4440-11-0x0000000000400000-0x0000000000F23040-memory.dmp

Filesize
11.1MB

Download
memory/4440-7-0x00000000001D0000-0x00000000001E0000-memory.dmp

Filesize
64KB

Download
memory/4440-8-0x00000000001D0000-0x00000000001E0000-memory.dmp

Filesize
64KB

Download
memory/4440-31-0x0000000004040000-0x00000000040F7000-memory.dmp

Filesize
732KB

Download
memory/4440-30-0x0000000003760000-0x0000000003761000-memory.dmp

Filesize
4KB

Download
memory/4440-28-0x00000000038A0000-0x00000000039CC000-memory.dmp

Filesize
1.2MB

Download
memory/4440-22-0x0000000000912000-0x0000000000F24000-memory.dmp

Filesize
6.1MB

Download
memory/4440-14-0x00000000038A0000-0x00000000039CC000-memory.dmp

Filesize
1.2MB

Download
memory/4440-27-0x0000000000400000-0x0000000000F23040-memory.dmp

Filesize
11.1MB

Download
memory/4440-24-0x0000000004040000-0x00000000040F7000-memory.dmp

Filesize
732KB

Download
memory/4440-23-0x0000000003760000-0x0000000003761000-memory.dmp

Filesize
4KB

Download
memory/4440-12-0x0000000001810000-0x0000000001928000-memory.dmp

Filesize
1.1MB

Download
memory/4440-19-0x0000000000400000-0x0000000000F23040-memory.dmp

Filesize
11.1MB

Download
memory/4440-20-0x0000000000912000-0x0000000000F24000-memory.dmp

Filesize
6.1MB

Download
memory/4440-21-0x0000000000400000-0x0000000000F23040-memory.dmp

Filesize
11.1MB

Download
memory/4816-13-0x0000000003560000-0x0000000003563000-memory.dmp

Filesize
12KB

Download
memory/4816-15-0x0000000003650000-0x00000000036BC000-memory.dmp

Filesize
432KB

Download
memory/4816-6-0x0000000003650000-0x00000000036BC000-memory.dmp

Filesize
432KB

Download
memory/4816-1-0x0000000003560000-0x0000000003563000-memory.dmp

Filesize
12KB

Download
memory/4816-0-0x0000000000400000-0x0000000001803000-memory.dmp

Filesize
20.0MB

Download
memory/4816-9-0x0000000000400000-0x0000000001803000-memory.dmp

Filesize
20.0MB

Download
memory/4816-5-0x0000000005240000-0x0000000005340000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads