blackmoon | 6599ac1a2989d47169b949c86e00ff4b953253f592730b65f8e310b3d05e7653

Analysis

max time kernel
155s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
16/11/2023, 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6599ac1a2989d47169b949c86e00ff4b953253f592730b65f8e310b3d05e7653.exe
Size

645KB
MD5

283534d73495dcf44f04a0b3b7e00d51
SHA1

0f16705ebd2148b5379a89787a2511b3dd47fb96
SHA256

6599ac1a2989d47169b949c86e00ff4b953253f592730b65f8e310b3d05e7653
SHA512

a9967a8c16183075d012ba17e9a5dd81cb36fa9eb1e53ebfdda392fd23fb9563086b3a374617564ce13d7f0080a6a107c3bdd31ebd0becb7ff4b6fdfd44da96f
SSDEEP

6144:MbpYL+RURgIp2M0JwTzNKNQdifAIt1RitoXc4NaskpNPSoOfbs5X5aIsGXE3NGig:GlmRggaw1ItjXNwXs9En

Score

10^/10

blackmoon banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 3 IoCs

resource	yara_rule
behavioral2/memory/4980-10-0x0000000003200000-0x00000000032EB000-memory.dmp	family_blackmoon
behavioral2/memory/4980-13-0x0000000003200000-0x00000000032EB000-memory.dmp	family_blackmoon
behavioral2/memory/4980-34-0x0000000003200000-0x00000000032EB000-memory.dmp	family_blackmoon

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	6599ac1a2989d47169b949c86e00ff4b953253f592730b65f8e310b3d05e7653.exe

Loads dropped DLL 1 IoCs

pid	Process
4980	6599ac1a2989d47169b949c86e00ff4b953253f592730b65f8e310b3d05e7653.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings	6599ac1a2989d47169b949c86e00ff4b953253f592730b65f8e310b3d05e7653.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2440	NOTEPAD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4980	6599ac1a2989d47169b949c86e00ff4b953253f592730b65f8e310b3d05e7653.exe
4980	6599ac1a2989d47169b949c86e00ff4b953253f592730b65f8e310b3d05e7653.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 2440	4980	6599ac1a2989d47169b949c86e00ff4b953253f592730b65f8e310b3d05e7653.exe	91
PID 4980 wrote to memory of 2440	4980	6599ac1a2989d47169b949c86e00ff4b953253f592730b65f8e310b3d05e7653.exe	91
PID 4980 wrote to memory of 2440	4980	6599ac1a2989d47169b949c86e00ff4b953253f592730b65f8e310b3d05e7653.exe	91

C:\Users\Admin\AppData\Local\Temp\6599ac1a2989d47169b949c86e00ff4b953253f592730b65f8e310b3d05e7653.exe
"C:\Users\Admin\AppData\Local\Temp\6599ac1a2989d47169b949c86e00ff4b953253f592730b65f8e310b3d05e7653.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\6599ac1a2989d47169b949c86e00ff4b953253f592730b65f8e310b3d05e7653.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6599ac1a2989d47169b949c86e00ff4b953253f592730b65f8e310b3d05e7653.txt

Filesize
649KB

MD5
d504f3e79833f38f69ab0696a9ed8205

SHA1
88ca3e8ec7886048102125539b22b2e7d3ec3dc5

SHA256
174c0c0d80346d35c31674baf20f06040341ebd6b5103c762e64fb7e1b4a244c

SHA512
bc28d5566b5569f3a69ceb6b7c6db200aa22d6fcc41d4c03b18472143a44b58e8e4afa7d445c573d75f2cd3d375ae3cf568bc23f13e342cc80ee9f84c74638c1

Download Submit
C:\Users\Public\Documents\qsxh.dll

Filesize
2KB

MD5
7943effe67a4647e06def2348949020e

SHA1
eabd561f0639a975de259633f63896d82c3f878d

SHA256
3fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa

SHA512
c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003

Download Submit
C:\Users\Public\Documents\sjsw.log

Filesize
248B

MD5
b4374df53591424691d6763a2a2ded78

SHA1
24ef8f85440bfe33c3cb0b7233a1683147552096

SHA256
0f3a41ee86d6eb2b3aaf78d34c0703b070ceb17080f7b8d1a14bcb8257713f47

SHA512
70f4f0336f58bd448256f9ca4a236d717257a898033cdd02495c4af72e7fe780346f134a4a180ce917794742673bcecb8a0c826033b826568f3f99b3950c7c60

Download Submit
memory/4980-4-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/4980-3-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/4980-0-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/4980-10-0x0000000003200000-0x00000000032EB000-memory.dmp

Filesize
940KB

Download
memory/4980-11-0x00000000032F0000-0x00000000032F3000-memory.dmp

Filesize
12KB

Download
memory/4980-13-0x0000000003200000-0x00000000032EB000-memory.dmp

Filesize
940KB

Download
memory/4980-2-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/4980-1-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/4980-31-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/4980-32-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/4980-34-0x0000000003200000-0x00000000032EB000-memory.dmp

Filesize
940KB

Download