blackmoon | b3010787750cb14924c05a52aa33f8b3b38e0d716b5b9381e221f684e2ae4235

General

Target

ef90a49f2f21dff28fe33ad85600d13b.exe
Size

4.5MB
MD5

ef90a49f2f21dff28fe33ad85600d13b
SHA1

000c835e0f1f5d16a104a230ad6220d982876bfe
SHA256

b3010787750cb14924c05a52aa33f8b3b38e0d716b5b9381e221f684e2ae4235
SHA512

396777f08d2204ecc2647d2e98318234d22c05e221ca4ce26c1078232ebc21198e3b9bccaa6e1544f4b4b0b314b3e846df816559b6149d8cbac7fa19ebdb95f6
SSDEEP

49152:+lozaRGEgKs/5SP4cKgBhD1cK72HDPNUeFwbDQeq8Yy3FLpNGuoenW0Knl:WAaRGEfs/jxw77mPNU+SDQW9ceW0Kl

Score

10^/10

blackmoon banker trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

resource	yara_rule
behavioral2/memory/4720-0-0x0000000000400000-0x000000000088A000-memory.dmp	family_blackmoon
behavioral2/memory/4720-66-0x0000000000400000-0x000000000088A000-memory.dmp	family_blackmoon

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4720-1-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-3-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-4-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-7-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-5-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-6-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-10-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-12-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-14-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-16-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-18-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-21-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-24-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-26-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-28-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-30-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-32-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-35-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-37-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-39-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-41-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-43-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-46-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-48-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-53-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-51-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4720-54-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3332	4720	WerFault.exe	89
464	4720	WerFault.exe	89

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4720	ef90a49f2f21dff28fe33ad85600d13b.exe
4720	ef90a49f2f21dff28fe33ad85600d13b.exe
4720	ef90a49f2f21dff28fe33ad85600d13b.exe
4720	ef90a49f2f21dff28fe33ad85600d13b.exe

C:\Users\Admin\AppData\Local\Temp\ef90a49f2f21dff28fe33ad85600d13b.exe
"C:\Users\Admin\AppData\Local\Temp\ef90a49f2f21dff28fe33ad85600d13b.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 1932
  2⤵
  - Program crash
  PID:3332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 1928
  2⤵
  - Program crash
  PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4720 -ip 4720
1⤵
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4720 -ip 4720
1⤵
PID:1316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4720-0-0x0000000000400000-0x000000000088A000-memory.dmp

Filesize
4.5MB

Download
memory/4720-1-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-3-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-4-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-7-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-5-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-6-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-10-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-12-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-14-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-16-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-18-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-21-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-24-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-26-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-28-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-30-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-32-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-35-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-37-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-39-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-41-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-43-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-46-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-48-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-53-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-51-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-54-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4720-66-0x0000000000400000-0x000000000088A000-memory.dmp

Filesize
4.5MB

Download

Analysis

Sharing