blackmoon | ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d

General

Target

ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
Size

1.7MB
MD5

6080e9547f8af7cabd9fa3196876e1f7
SHA1

9a56418b0235be258deeda73898f9e24272df8e0
SHA256

ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d
SHA512

7bfa3a4062673f02566e77509c0809d70cb7183612b92a6f82b5f145557baeb15f90eb2916f3c58daff1199a0781b9a01a08401c6247b9d1881cedeb6af48528
SSDEEP

24576:QksPIUC2bdAjAQrJlbie+NAbB0DKj2pE2FhgzPow09mo7TnB5XwEDsj6GKL:BUdQKuN0ekEkg7owBI/wEM6GM

Score

10^/10

blackmoon banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 4 IoCs

resource	yara_rule
behavioral2/memory/660-13078-0x0000000010000000-0x000000001001F000-memory.dmp	family_blackmoon
behavioral2/memory/660-13079-0x0000000010000000-0x000000001001F000-memory.dmp	family_blackmoon
behavioral2/memory/660-13080-0x0000000010000000-0x000000001001F000-memory.dmp	family_blackmoon
behavioral2/memory/660-13106-0x0000000010000000-0x000000001001F000-memory.dmp	family_blackmoon

Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs

pid	Process
660	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
660	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
660	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
660	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
660	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
660	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
660	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
660	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
660	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
660	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
660	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
660	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
660	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5044	660	WerFault.exe	81

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Software\Microsoft\Internet Explorer\DOMStorage\xui.ptlogin2.qq.com	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\qq.com\Total = "44"	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe = "10002"	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
Key created	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
Key created	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\qq.com	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\qq.com\NumberOfSubdomains = "1"	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "44"	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe = "10002"	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
Key created	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
Key created	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Software\Microsoft\Internet Explorer\DOMStorage\qq.com	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
Key created	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\xui.ptlogin2.qq.com\ = "44"	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
660	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
660	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
660	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
660	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
660	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
660	ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe

C:\Users\Admin\AppData\Local\Temp\ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe
"C:\Users\Admin\AppData\Local\Temp\ae5d6cf11531f779d3b4d5c191ee751b5d89e6d832dbecc733ef64cb2af0b04d.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 660 -s 2688
  2⤵
  - Program crash
  PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 660 -ip 660
1⤵
PID:4696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/660-0-0x0000000000400000-0x00000000006A1000-memory.dmp

Filesize
2.6MB

Download
memory/660-1-0x00000000750C0000-0x00000000752D5000-memory.dmp

Filesize
2.1MB

Download
memory/660-3875-0x0000000076680000-0x0000000076820000-memory.dmp

Filesize
1.6MB

Download
memory/660-5884-0x00000000755F0000-0x000000007566A000-memory.dmp

Filesize
488KB

Download
memory/660-13069-0x0000000000400000-0x00000000006A1000-memory.dmp

Filesize
2.6MB

Download
memory/660-13070-0x0000000000400000-0x00000000006A1000-memory.dmp

Filesize
2.6MB

Download
memory/660-13071-0x0000000000400000-0x00000000006A1000-memory.dmp

Filesize
2.6MB

Download
memory/660-13072-0x0000000000400000-0x00000000006A1000-memory.dmp

Filesize
2.6MB

Download
memory/660-13074-0x0000000000400000-0x00000000006A1000-memory.dmp

Filesize
2.6MB

Download
memory/660-13075-0x0000000000400000-0x00000000006A1000-memory.dmp

Filesize
2.6MB

Download
memory/660-13076-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/660-13078-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/660-13079-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/660-13080-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/660-13081-0x0000000004410000-0x0000000004450000-memory.dmp

Filesize
256KB

Download
memory/660-13095-0x0000000000400000-0x00000000006A1000-memory.dmp

Filesize
2.6MB

Download
memory/660-13105-0x0000000000400000-0x00000000006A1000-memory.dmp

Filesize
2.6MB

Download
memory/660-13106-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing