blackmoon | b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc

General

Target

b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe
Size

6.6MB
MD5

38a97ade010cde6837b5f8d071889a78
SHA1

97ed44e3acba9d141d1886366f7a1b436bff60be
SHA256

b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc
SHA512

ac5fd0dbc39946ebb09ab8a8fff94e08dae9831772c95c687fc26081d648fc9a8d5f8cd11a07b72fa3399f5391b241a86f830388bea3997f1cb24c1e4bf531b9
SSDEEP

98304:grnWaD3WidnvscLH9YqdwkLcHHHO8olV5o6QH6ewGkt10ETN:AnJWifLH9jAuNo6QabGZEh

Score

10^/10

blackmoon banker trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 6 IoCs

resource	yara_rule
behavioral1/memory/1664-4-0x0000000000400000-0x0000000000AE7000-memory.dmp	family_blackmoon
behavioral1/memory/1664-6-0x0000000000400000-0x0000000000AE7000-memory.dmp	family_blackmoon
behavioral1/memory/1664-19-0x0000000000400000-0x0000000000AE7000-memory.dmp	family_blackmoon
behavioral1/memory/1664-24-0x0000000000400000-0x0000000000AE7000-memory.dmp	family_blackmoon
behavioral1/memory/1664-58-0x0000000000400000-0x0000000000AE7000-memory.dmp	family_blackmoon
behavioral1/memory/1664-83-0x0000000000400000-0x0000000000AE7000-memory.dmp	family_blackmoon

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0010000000014909-22.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
1664	b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1664-0-0x0000000010000000-0x0000000010019000-memory.dmp	upx
behavioral1/files/0x0010000000014909-22.dat	upx
behavioral1/memory/1664-27-0x0000000002740000-0x000000000277D000-memory.dmp	upx
behavioral1/memory/1664-28-0x0000000002740000-0x000000000277D000-memory.dmp	upx
behavioral1/memory/1664-29-0x0000000002740000-0x000000000277D000-memory.dmp	upx
behavioral1/memory/3064-32-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral1/memory/3064-35-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral1/memory/3064-38-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral1/memory/3064-43-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral1/memory/3064-45-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral1/memory/3064-46-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral1/memory/3064-47-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral1/memory/3064-49-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral1/memory/3064-52-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral1/memory/1664-57-0x0000000010000000-0x0000000010019000-memory.dmp	upx
behavioral1/memory/3064-85-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral1/memory/3064-86-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral1/memory/3064-87-0x0000000000400000-0x000000000052C000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\BackInC.sys	b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe
File created	C:\Windows\SysWOW64\Dult.dll	b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1664 set thread context of 3064	1664	b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
468	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1664	b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe
Token: SeDebugPrivilege	1664	b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe
Token: SeDebugPrivilege	1664	b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe
Token: 1	1664	b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe
Token: SeDebugPrivilege	1664	b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1664	b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe
1664	b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe
1664	b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2504	1664	b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe	28
PID 1664 wrote to memory of 2504	1664	b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe	28
PID 1664 wrote to memory of 2504	1664	b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe	28
PID 1664 wrote to memory of 2504	1664	b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe	28
PID 1664 wrote to memory of 3064	1664	b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe	29
PID 1664 wrote to memory of 3064	1664	b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe	29
PID 1664 wrote to memory of 3064	1664	b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe	29
PID 1664 wrote to memory of 3064	1664	b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe	29
PID 1664 wrote to memory of 3064	1664	b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe	29
PID 1664 wrote to memory of 3064	1664	b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe	29
PID 1664 wrote to memory of 3064	1664	b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe	29
PID 1664 wrote to memory of 3064	1664	b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe	29

C:\Users\Admin\AppData\Local\Temp\b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe
"C:\Users\Admin\AppData\Local\Temp\b8c4dd094f0e014b88c6e5ff26907a6c2d1642dcc96e8e7c57d947b0a82bc9fc.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:2504
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\SkinH_EL.dll

Filesize
86KB

MD5
147127382e001f495d1842ee7a9e7912

SHA1
92d1ed56032183c75d4b57d7ce30b1c4ae11dc9b

SHA256
edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc

SHA512
97f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d

Download Submit
memory/1664-24-0x0000000000400000-0x0000000000AE7000-memory.dmp

Filesize
6.9MB

Download
memory/1664-4-0x0000000000400000-0x0000000000AE7000-memory.dmp

Filesize
6.9MB

Download
memory/1664-6-0x0000000000400000-0x0000000000AE7000-memory.dmp

Filesize
6.9MB

Download
memory/1664-19-0x0000000000400000-0x0000000000AE7000-memory.dmp

Filesize
6.9MB

Download
memory/1664-3-0x0000000000CC0000-0x0000000000CD4000-memory.dmp

Filesize
80KB

Download
memory/1664-0-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/1664-27-0x0000000002740000-0x000000000277D000-memory.dmp

Filesize
244KB

Download
memory/1664-26-0x0000000000F40000-0x0000000000F41000-memory.dmp

Filesize
4KB

Download
memory/1664-28-0x0000000002740000-0x000000000277D000-memory.dmp

Filesize
244KB

Download
memory/1664-29-0x0000000002740000-0x000000000277D000-memory.dmp

Filesize
244KB

Download
memory/1664-83-0x0000000000400000-0x0000000000AE7000-memory.dmp

Filesize
6.9MB

Download
memory/1664-58-0x0000000000400000-0x0000000000AE7000-memory.dmp

Filesize
6.9MB

Download
memory/1664-57-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3064-38-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3064-49-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3064-43-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3064-45-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3064-46-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3064-47-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3064-48-0x0000000075310000-0x0000000075342000-memory.dmp

Filesize
200KB

Download
memory/3064-39-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3064-52-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3064-35-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3064-32-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3064-30-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3064-85-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3064-86-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3064-87-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3064-88-0x0000000075310000-0x0000000075342000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing