blackmoon | 6c13d1ffcaa86e0fbe2cce1b69789d7d7c0aa98e4358dd044287e913d07d7e15

Analysis

max time kernel
7s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 15:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
02f289afea55562825514bea687992fe.exe
Size 129KB
Sample231224-sgxchabefj
SHA256 6c13d1ffcaa86e0fbe2cce1b69789d7d7c0aa98e4358dd044287e913d07d7e15
MD5 02f289afea55562825514bea687992fe
SHA1 b2acd397873bb99b15772397b3c8d9187cef9bc0
SHA512 4294716259c073357e4dfc7e712a9fc089703614e449c65db2899f58fdb9e5655e221733933c5527f7c21840c4c17f344d43032d93ca0911978c4a180c4285f5
SSDEEP 3072:Pn+NcOOqIGx6PBewfgJE0O1kL1q4n4EvqA6rRrr0W5Pt1eJuwout:P+NXvIGEPBeY0O0fn61rrL51/woS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackmoon banker persistence trojan vmprotect

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral2/memory/2176-16-0x0000000000400000-0x000000000043D000-memory.dmp	family_blackmoon

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	02f289afea55562825514bea687992fe.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	VnrYne173.exe

Executes dropped EXE 1 IoCs

pid	Process
4844	VnrYne173.exe

Loads dropped DLL 1 IoCs

pid	Process
1348	rundll32.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x000a000000023139-12.dat	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Configuring = "rundll32.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\240606750.txt,M"	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2176	02f289afea55562825514bea687992fe.exe
2176	02f289afea55562825514bea687992fe.exe
2176	02f289afea55562825514bea687992fe.exe
2176	02f289afea55562825514bea687992fe.exe
2176	02f289afea55562825514bea687992fe.exe
2176	02f289afea55562825514bea687992fe.exe
2176	02f289afea55562825514bea687992fe.exe
2176	02f289afea55562825514bea687992fe.exe
2176	02f289afea55562825514bea687992fe.exe
2176	02f289afea55562825514bea687992fe.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1348	rundll32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 4844	2176	02f289afea55562825514bea687992fe.exe	43
PID 2176 wrote to memory of 4844	2176	02f289afea55562825514bea687992fe.exe	43
PID 2176 wrote to memory of 4844	2176	02f289afea55562825514bea687992fe.exe	43
PID 4844 wrote to memory of 1348	4844	VnrYne173.exe	93
PID 4844 wrote to memory of 1348	4844	VnrYne173.exe	93
PID 4844 wrote to memory of 1348	4844	VnrYne173.exe	93
PID 4844 wrote to memory of 1168	4844	VnrYne173.exe	95
PID 4844 wrote to memory of 1168	4844	VnrYne173.exe	95
PID 4844 wrote to memory of 1168	4844	VnrYne173.exe	95
PID 2176 wrote to memory of 640	2176	02f289afea55562825514bea687992fe.exe	97
PID 2176 wrote to memory of 640	2176	02f289afea55562825514bea687992fe.exe	97
PID 2176 wrote to memory of 640	2176	02f289afea55562825514bea687992fe.exe	97

C:\Users\Admin\AppData\Local\Temp\02f289afea55562825514bea687992fe.exe
"C:\Users\Admin\AppData\Local\Temp\02f289afea55562825514bea687992fe.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Users\Admin\AppData\Local\Temp\VnrYne173.exe
  C:\Users\Admin\AppData\Local\Temp\VnrYne173.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\240606750.txt,M
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of SetWindowsHookEx
    PID:1348
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240606750.bat
    3⤵
    PID:1168
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\02f289afea55562825514bea687992fe.exe"
  2⤵
  PID:640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

240606750.bat

Path C:\Users\Admin\AppData\Local\Temp\240606750.bat
Size 132B
SHA256 413d25d0266693bcfc838d8abae2ff1990399728064f8fa486db7a4cbd2ea5bb
MD5 94c81f4fa825da5f7cd0ab04a1a57fe0
SHA1 5b47232a4a31c98c935112704c6a125a874d1a57
SHA512 a63d50b52405a8c8aeefb9db349838805ec7dd50598a5a558d923301ee00d61cc98df3fc71e716e81be38b017f0c9ee59def855e6a8a06f0d8d8c2e61c2a301c
MD5 SHA1 SHA512

Submit Download

240606750.txt

Path C:\Users\Admin\AppData\Local\Temp\240606750.txt
Size 103KB
SHA256 468b8405b225f8827b9eb7a7df35d24d2e432121a044fac4f0ebea640167a1fb
MD5 c7512a48cb90ac1515aed615315fe7cf
SHA1 3e4ea26b47144e5f59ed554ca935d8edf2aac75a
SHA512 f1c4f07c33834241b51460bc382dfe6fc290565224f01147927e58f9b4a57965f5dd14c5f585e175e447c4ed6d9b4551946ed34a0409e80448ec2d489ebc1d8c
SSDEEP 1536:7VFYB6kZ45j1youkr7UzXXK77N/N2SGEuS2iKxQXX2m9ms9jeD5AtCEhzS4TMBe:kBFZYJyoukMzmms4D59yW4Q0
MD5 SHA1 SHA512 SSDEEP

Submit Download

VnrYne173.exe

Path C:\Users\Admin\AppData\Local\Temp\VnrYne173.exe
Size 480KB
SHA256 2d9d1366576b7d0f390c9189fcf1c298534e6bd133f9c38c41fe2435cac27b76
MD5 66a948b991374ef94023ad102acdf23c
SHA1 ebd4007813bbc3ee4cfab4a0967bcd676c678cbd
SHA512 8df007ab5c6f255a0b4fb4bf793c7bc1996d1745d1b381b45f53d4216021deb9677cb78cf8b4794697cec8612021597afa1974f6e54180901b528ea7383dfc14
SSDEEP 3072:sP5RHPudQ1VblbajKFRudepWHkIPPtGo:sPHWdIBlG+Rq0WHkIHtZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

VnrYne173.exe

Path C:\Users\Admin\AppData\Local\Temp\VnrYne173.exe
Size 474KB
SHA256 8fcb553bd67fb93112f6ab189e9c1de390a2987b47188bc91f7979d9f291405c
MD5 d91ad947b3202515b5dfa13a492e8e5a
SHA1 758adb2c8273af14616910a49bfcad28baa45cfd
SHA512 c30c6f916e2f195f867e7daaa1f5bc6b710889b6bb01f60ca70316b18c597ed4ca40acc7a0552219946806cb1315864538e8a7c37fb7780c26d2a461fd7f47df
SSDEEP 3072:sP5RHPudQ1VblbajKFRudepWHkIPPtGo:sPHWdIBlG+Rq0WHkIHtZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2176-0-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2176-16-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4844-7-0x000000000C280000-0x000000000C2B7000-memory.dmp

Download

memory/4844-6-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/4844-11-0x0000000000400000-0x0000000001400000-memory.dmp

Download