blackmoon | 83ecee5acafd409589155cdb97d5ce777c24e65d7b1c9fe5e4875882219e8239

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/04/2024, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
83ecee5acafd409589155cdb97d5ce777c24e65d7b1c9fe5e4875882219e8239.exe
Size 156KB
Sample240407-sk6eksfe65
SHA256 83ecee5acafd409589155cdb97d5ce777c24e65d7b1c9fe5e4875882219e8239
MD5 b9246e45f4048b90a61857e98b0b2b39
SHA1 a319e7d377bf80ed2661dea943a3bcdb4733f605
SHA512 f945ca4102331ae6c5996d6e042044a3984c7ebca5ae254877241f4c8395b8dc19720fe958f6dbab7b095a324e1c18ea21b9dcd7a45d5e86ceae60ea4a34a966
SSDEEP 1536:ej+zUtBIBU+2Da4lH4Iiue58o/ZDv4GMfcHZIlVKAn5ZAcXeOqbZ6NjkEVnouy8Y:eqSe5OmiEoAcCbZ6FNoutb0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackmoon banker trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 4 IoCs

resource	yara_rule
behavioral1/memory/1300-2-0x0000000000400000-0x0000000000429000-memory.dmp	family_blackmoon
behavioral1/files/0x000d000000015c5a-7.dat	family_blackmoon
behavioral1/memory/1300-3-0x00000000002D0000-0x00000000002F9000-memory.dmp	family_blackmoon
behavioral1/memory/2368-11-0x0000000000400000-0x0000000000429000-memory.dmp	family_blackmoon

Deletes itself 1 IoCs

pid	Process
2368	xl860.exe

Executes dropped EXE 1 IoCs

pid	Process
2368	xl860.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1300-2-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/files/0x000d000000015c5a-7.dat	upx
behavioral1/memory/1300-3-0x00000000002D0000-0x00000000002F9000-memory.dmp	upx
behavioral1/memory/2368-11-0x0000000000400000-0x0000000000429000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	\??\c:\windows\friendl.dll	xl860.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 2368	1300	83ecee5acafd409589155cdb97d5ce777c24e65d7b1c9fe5e4875882219e8239.exe	28
PID 1300 wrote to memory of 2368	1300	83ecee5acafd409589155cdb97d5ce777c24e65d7b1c9fe5e4875882219e8239.exe	28
PID 1300 wrote to memory of 2368	1300	83ecee5acafd409589155cdb97d5ce777c24e65d7b1c9fe5e4875882219e8239.exe	28
PID 1300 wrote to memory of 2368	1300	83ecee5acafd409589155cdb97d5ce777c24e65d7b1c9fe5e4875882219e8239.exe	28

C:\Users\Admin\AppData\Local\Temp\83ecee5acafd409589155cdb97d5ce777c24e65d7b1c9fe5e4875882219e8239.exe
"C:\Users\Admin\AppData\Local\Temp\83ecee5acafd409589155cdb97d5ce777c24e65d7b1c9fe5e4875882219e8239.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- \??\c:\xl860.exe
  c:\xl860.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:2368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

xl860.exe

Path C:\xl860.exe
Size 156KB
SHA256 28d0c6428353cf7f94a1804097b49543e32d5041c7b1ba29ea10f180a116417e
MD5 5d3fa148e87d5cad58be454a601e7f22
SHA1 b7ddbaa5723b46428a94633ff93e51e095ce5e91
SHA512 8dae75576cf680c33b6ea974c921e08061fc61664fcc4dba1770efe0ca1abc1fba60ea60e8f3801d4edd7c31efbd7d5c317a18f38a31612f98d47d34a71da875
SSDEEP 1536:ej+zUtBIBU+2Da4lH4Iiue58o/ZDv4GMfcHZIlVKAn5ZAcXeOqbZ6NjkEVnouy8P:eqSe5OmiEoAcCbZ6FNoutbr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path \??\c:\jl
Size 102B
SHA256 d2d0aa59f342dbe45a02e210038a25fd25fb45ba411a3077d4ed9a7db7ac07c1
MD5 6ee9e12f7b0b6a8801e49663abe1ba86
SHA1 99f6eafb45ddb2ca4bf7771737bb8661111e760e
SHA512 e2aa57cfd927580647855b3ee06a593812f8fab820bda7b20d2dc239df3d94a674ea0d5bb68a6210ec9e5cc3831f69157aed9441d2349de4a63a8e84fb091659
MD5 SHA1 SHA512

Submit Download

memory/1300-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1300-3-0x00000000002D0000-0x00000000002F9000-memory.dmp

Download

memory/2368-11-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads