blackmoon | 29268d0cd89d57a73d7847e3a240ec424985ae0176eda1b91a3ec3c4c1067837

Analysis

max time kernel
141s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29268d0cd89d57a73d7847e3a240ec424985ae0176eda1b91a3ec3c4c1067837.exe
Size

13.1MB
MD5

744c2727bd6be3851d2510b239703569
SHA1

fcfae2bf675feb13ea6c3982ef4d76048ba6b072
SHA256

29268d0cd89d57a73d7847e3a240ec424985ae0176eda1b91a3ec3c4c1067837
SHA512

d6bcfc48348052488747d767c75f7d666b727b64ca5aad3cc86d5688b73f7e1a5e720a02aeca0705d7e00cfa82cc2619050ff0213cf19a7768e19d6856180172
SSDEEP

393216:6dAiIq9yVYbXUfuq5PJloo6T8SwOy3GoBF:ZGyVYbXUmlbT8SwIG

Score

10^/10

blackmoon banker trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 12 IoCs

resource	yara_rule
behavioral1/memory/2140-23-0x0000000000400000-0x0000000001D7F000-memory.dmp	family_blackmoon
behavioral1/memory/2140-49-0x0000000000400000-0x0000000001D7F000-memory.dmp	family_blackmoon
behavioral1/memory/2140-71-0x0000000000400000-0x0000000001D7F000-memory.dmp	family_blackmoon
behavioral1/memory/2140-74-0x0000000000400000-0x0000000001D7F000-memory.dmp	family_blackmoon
behavioral1/memory/2140-77-0x0000000000400000-0x0000000001D7F000-memory.dmp	family_blackmoon
behavioral1/memory/2140-79-0x0000000000400000-0x0000000001D7F000-memory.dmp	family_blackmoon
behavioral1/memory/2140-81-0x0000000000400000-0x0000000001D7F000-memory.dmp	family_blackmoon
behavioral1/memory/2140-83-0x0000000000400000-0x0000000001D7F000-memory.dmp	family_blackmoon
behavioral1/memory/2140-85-0x0000000000400000-0x0000000001D7F000-memory.dmp	family_blackmoon
behavioral1/memory/2140-87-0x0000000000400000-0x0000000001D7F000-memory.dmp	family_blackmoon
behavioral1/memory/2140-89-0x0000000000400000-0x0000000001D7F000-memory.dmp	family_blackmoon
behavioral1/memory/2140-91-0x0000000000400000-0x0000000001D7F000-memory.dmp	family_blackmoon

Executes dropped EXE 1 IoCs

pid	Process
2556	aria2c.exe

Loads dropped DLL 3 IoCs

pid	Process
2140	29268d0cd89d57a73d7847e3a240ec424985ae0176eda1b91a3ec3c4c1067837.exe
2140	29268d0cd89d57a73d7847e3a240ec424985ae0176eda1b91a3ec3c4c1067837.exe
572	Process not Found

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2140-0-0x0000000000400000-0x0000000001D7F000-memory.dmp	upx
behavioral1/memory/2140-5-0x00000000041F0000-0x0000000004791000-memory.dmp	upx
behavioral1/memory/2140-6-0x00000000041F0000-0x0000000004791000-memory.dmp	upx
behavioral1/memory/2140-9-0x0000000004050000-0x000000000410E000-memory.dmp	upx
behavioral1/memory/2140-13-0x0000000004050000-0x000000000410E000-memory.dmp	upx
behavioral1/memory/2140-23-0x0000000000400000-0x0000000001D7F000-memory.dmp	upx
behavioral1/memory/2140-25-0x00000000041F0000-0x0000000004791000-memory.dmp	upx
behavioral1/memory/2140-49-0x0000000000400000-0x0000000001D7F000-memory.dmp	upx
behavioral1/memory/2140-71-0x0000000000400000-0x0000000001D7F000-memory.dmp	upx
behavioral1/memory/2140-74-0x0000000000400000-0x0000000001D7F000-memory.dmp	upx
behavioral1/memory/2140-77-0x0000000000400000-0x0000000001D7F000-memory.dmp	upx
behavioral1/memory/2140-79-0x0000000000400000-0x0000000001D7F000-memory.dmp	upx
behavioral1/memory/2140-81-0x0000000000400000-0x0000000001D7F000-memory.dmp	upx
behavioral1/memory/2140-83-0x0000000000400000-0x0000000001D7F000-memory.dmp	upx
behavioral1/memory/2140-85-0x0000000000400000-0x0000000001D7F000-memory.dmp	upx
behavioral1/memory/2140-87-0x0000000000400000-0x0000000001D7F000-memory.dmp	upx
behavioral1/memory/2140-89-0x0000000000400000-0x0000000001D7F000-memory.dmp	upx
behavioral1/memory/2140-91-0x0000000000400000-0x0000000001D7F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	29268d0cd89d57a73d7847e3a240ec424985ae0176eda1b91a3ec3c4c1067837.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	29268d0cd89d57a73d7847e3a240ec424985ae0176eda1b91a3ec3c4c1067837.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2140	29268d0cd89d57a73d7847e3a240ec424985ae0176eda1b91a3ec3c4c1067837.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2140	29268d0cd89d57a73d7847e3a240ec424985ae0176eda1b91a3ec3c4c1067837.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2140	29268d0cd89d57a73d7847e3a240ec424985ae0176eda1b91a3ec3c4c1067837.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2140	29268d0cd89d57a73d7847e3a240ec424985ae0176eda1b91a3ec3c4c1067837.exe
2140	29268d0cd89d57a73d7847e3a240ec424985ae0176eda1b91a3ec3c4c1067837.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2556	2140	29268d0cd89d57a73d7847e3a240ec424985ae0176eda1b91a3ec3c4c1067837.exe	30
PID 2140 wrote to memory of 2556	2140	29268d0cd89d57a73d7847e3a240ec424985ae0176eda1b91a3ec3c4c1067837.exe	30
PID 2140 wrote to memory of 2556	2140	29268d0cd89d57a73d7847e3a240ec424985ae0176eda1b91a3ec3c4c1067837.exe	30
PID 2140 wrote to memory of 2556	2140	29268d0cd89d57a73d7847e3a240ec424985ae0176eda1b91a3ec3c4c1067837.exe	30

C:\Users\Admin\AppData\Local\Temp\29268d0cd89d57a73d7847e3a240ec424985ae0176eda1b91a3ec3c4c1067837.exe
"C:\Users\Admin\AppData\Local\Temp\29268d0cd89d57a73d7847e3a240ec424985ae0176eda1b91a3ec3c4c1067837.exe"
1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Users\Admin\AppData\Roaming\Downloader\aria2c.exe
  "C:\Users\Admin\AppData\Roaming\Downloader\aria2c.exe" --conf-path="C:\Users\Admin\AppData\Roaming\Downloader\aria2.conf" #--save-session="C:\Users\Admin\AppData\Roaming\Downloader\aria2.session" --input-file="C:\Users\Admin\AppData\Roaming\Downloader\aria2.session" --rpc-listen-port=6288 --listen-port=6388 --dht-listen-port=6390 --enable-rpc=true --rpc-allow-origin-all=true --disable-ipv6=false --rpc-secret=123 --enable-dht=true --enable-dht6=true --dht-file-path="C:\Users\Admin\AppData\Roaming\Downloader\dht.dat" --dht-file-path6="C:\Users\Admin\AppData\Roaming\Downloader\dht6.dat" --bt-external-ip= --stop-with-process=2140 --check-certificate=false
  2⤵
  - Executes dropped EXE
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Downloader\aria2.conf

Filesize
55KB

MD5
be2848313251cc4bdc3f4d83fbb678ee

SHA1
1e43738b25f0abcb6288e12b7e8d01b3e8666e8a

SHA256
35a633ec422857ce9d27f0e6b948d8b871af90c0430754bdd3f7ca70970e866d

SHA512
7093a99574544973a2c4ea9abebeefdb8b463bb42514a5d06dc29bff6cdd34381f10e394f79a8a5af1b27b86b5a31a71a48e569a2c76a20d4f982a5df61b3932

Download Submit
C:\Users\Admin\AppData\Roaming\Downloader\aria2c.exe

Filesize
2.7MB

MD5
b11a8b4beda1ecac9da2dcdaff1124d5

SHA1
18daa1e4ec3f5855bfd10a540a4c638f8626f715

SHA256
0f516f5653c307522bb408447d671aea4f38d85f4654bc18549c3b82350cde4a

SHA512
0c97d23029ca3ad06616164d8ee77f20c1c1db737f31d9165f89dde7609a84f7f4df506f08dad657f264cd19a71f81d0f8105faedfb6aaaf705ab61c10217853

Download Submit
\Users\Admin\AppData\Roaming\Downloader\aria2c.exe

Filesize
4.4MB

MD5
d8c66c8cfd6293fd5bd58ae07bf0e0de

SHA1
0f95673f9f2e1582b5e62b3b1240622fb0088fb6

SHA256
dc2ad83141bdf84feae1959b71e5f19a78c7f91b22d007f707f93e998a262e21

SHA512
3e1cbc197b068023ebd08e0622ff159f0f00dc9df77738d21f5d1ded0e1790622d35f77d5e7e5a8608025672d15b756a10e898d71fd9aee7eaed2b4e6522d86d

Download Submit
\Users\Admin\AppData\Roaming\Downloader\aria2c.exe

Filesize
1.6MB

MD5
38aee908a1f661310fcee9fbdc7ae812

SHA1
c27e1d7fb2fa4d8b755ffe8c2a13f5dcc3724c05

SHA256
ab4819561b1d097931228ef8218cea047fe4d0108d2cb9959045b62e5221c93c

SHA512
965c62efb66f610924cda40a4c1d6cdabe5631bd766360b81edb8a0e1b8dcf72c1c51bf8de75b5c875be17f3c54a485ffbc7800dd9b3f5a6e0d2c3be5ff5596d

Download Submit
\Users\Admin\AppData\Roaming\Downloader\libcurl.dll

Filesize
1.7MB

MD5
c827add774456c759d2a7b35a2ae3525

SHA1
e6817d1b5c62460bdfd4aa3cd3941a6e7ecdc533

SHA256
5eb7c4723acab028d8bfea807cae6dad1f38d2c21b11586d77a69a716fbc4f2a

SHA512
5febaf93c07eb86b2dd9a228fe18e55ba57183d7300c07da802ddf7d381c3138e20601386744e92caed15e183fa793969ce47fa799e9f124c3f09e0b2c1da22d

Download Submit
memory/2140-29-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2140-31-0x0000000075760000-0x0000000075870000-memory.dmp

Filesize
1.1MB

Download
memory/2140-10-0x00000000048C0000-0x00000000049D0000-memory.dmp

Filesize
1.1MB

Download
memory/2140-11-0x0000000000390000-0x00000000003AA000-memory.dmp

Filesize
104KB

Download
memory/2140-12-0x0000000075760000-0x0000000075870000-memory.dmp

Filesize
1.1MB

Download
memory/2140-13-0x0000000004050000-0x000000000410E000-memory.dmp

Filesize
760KB

Download
memory/2140-14-0x0000000075760000-0x0000000075870000-memory.dmp

Filesize
1.1MB

Download
memory/2140-15-0x0000000075760000-0x0000000075870000-memory.dmp

Filesize
1.1MB

Download
memory/2140-18-0x0000000075760000-0x0000000075870000-memory.dmp

Filesize
1.1MB

Download
memory/2140-19-0x0000000075760000-0x0000000075870000-memory.dmp

Filesize
1.1MB

Download
memory/2140-20-0x00000000003B0000-0x00000000003CA000-memory.dmp

Filesize
104KB

Download
memory/2140-8-0x0000000075760000-0x0000000075870000-memory.dmp

Filesize
1.1MB

Download
memory/2140-23-0x0000000000400000-0x0000000001D7F000-memory.dmp

Filesize
25.5MB

Download
memory/2140-25-0x00000000041F0000-0x0000000004791000-memory.dmp

Filesize
5.6MB

Download
memory/2140-27-0x0000000075760000-0x0000000075870000-memory.dmp

Filesize
1.1MB

Download
memory/2140-26-0x0000000000310000-0x000000000032A000-memory.dmp

Filesize
104KB

Download
memory/2140-28-0x0000000075760000-0x0000000075870000-memory.dmp

Filesize
1.1MB

Download
memory/2140-0-0x0000000000400000-0x0000000001D7F000-memory.dmp

Filesize
25.5MB

Download
memory/2140-30-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2140-9-0x0000000004050000-0x000000000410E000-memory.dmp

Filesize
760KB

Download
memory/2140-32-0x0000000075760000-0x0000000075870000-memory.dmp

Filesize
1.1MB

Download
memory/2140-7-0x0000000000310000-0x000000000032A000-memory.dmp

Filesize
104KB

Download
memory/2140-6-0x00000000041F0000-0x0000000004791000-memory.dmp

Filesize
5.6MB

Download
memory/2140-41-0x0000000075760000-0x0000000075870000-memory.dmp

Filesize
1.1MB

Download
memory/2140-5-0x00000000041F0000-0x0000000004791000-memory.dmp

Filesize
5.6MB

Download
memory/2140-1-0x0000000010000000-0x0000000010116000-memory.dmp

Filesize
1.1MB

Download
memory/2140-49-0x0000000000400000-0x0000000001D7F000-memory.dmp

Filesize
25.5MB

Download
memory/2140-91-0x0000000000400000-0x0000000001D7F000-memory.dmp

Filesize
25.5MB

Download
memory/2140-67-0x0000000073260000-0x0000000073351000-memory.dmp

Filesize
964KB

Download
memory/2140-71-0x0000000000400000-0x0000000001D7F000-memory.dmp

Filesize
25.5MB

Download
memory/2140-74-0x0000000000400000-0x0000000001D7F000-memory.dmp

Filesize
25.5MB

Download
memory/2140-75-0x0000000073260000-0x0000000073351000-memory.dmp

Filesize
964KB

Download
memory/2140-77-0x0000000000400000-0x0000000001D7F000-memory.dmp

Filesize
25.5MB

Download
memory/2140-79-0x0000000000400000-0x0000000001D7F000-memory.dmp

Filesize
25.5MB

Download
memory/2140-81-0x0000000000400000-0x0000000001D7F000-memory.dmp

Filesize
25.5MB

Download
memory/2140-83-0x0000000000400000-0x0000000001D7F000-memory.dmp

Filesize
25.5MB

Download
memory/2140-85-0x0000000000400000-0x0000000001D7F000-memory.dmp

Filesize
25.5MB

Download
memory/2140-87-0x0000000000400000-0x0000000001D7F000-memory.dmp

Filesize
25.5MB

Download
memory/2140-89-0x0000000000400000-0x0000000001D7F000-memory.dmp

Filesize
25.5MB

Download
memory/2556-66-0x0000000000400000-0x00000000008CE000-memory.dmp

Filesize
4.8MB

Download