blackmoon | c15b7d2402be8884b7f0e7cbc263e3b3c034601e559b530c55aeb5640ece8822 | Triage™

Analysis

max time kernel
402s
max time network
406s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
刺客远程控制破解版修复免杀过传输报毒.zip
Size 28.2MB
Sample240512-sdwlssef22
SHA256 c15b7d2402be8884b7f0e7cbc263e3b3c034601e559b530c55aeb5640ece8822
MD5 33a5ef7be9a92b856270684810c822ce
SHA1 ef7f1e074026c5f403dec1178913ed744d56f84c
SHA512 daabc739cd92b6170b16fa8cf324d53eacd483e27d0defa26cbab91310019d94d03acf072fd37d789f82735ac84ccffbdb556890585ab6ac0a38bfd999361547
SSDEEP 786432:1kbXX5Y+ExmlAYeUtDYgfBv+NvtCWPy5SU5CrPYn+EPU9SkKOw956RGxHg:iN5ExWm2YgfdytCWkSaCrPY+ErtxA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackmoon banker bootkit persistence trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral3/memory/4936-142-0x0000000000400000-0x0000000000C8B000-memory.dmp	family_blackmoon

Executes dropped EXE 1 IoCs

pid	Process
4936	刺客远程管理.exe

Loads dropped DLL 1 IoCs

pid	Process
4936	刺客远程管理.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	刺客远程管理.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4936	刺客远程管理.exe
4936	刺客远程管理.exe
4436	mspaint.exe
4436	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2752	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2752	7zFM.exe
Token: 35	2752	7zFM.exe
Token: SeSecurityPrivilege	2752	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2752	7zFM.exe
2752	7zFM.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4936	刺客远程管理.exe
4936	刺客远程管理.exe
4936	刺客远程管理.exe
4936	刺客远程管理.exe
4936	刺客远程管理.exe
4936	刺客远程管理.exe
4936	刺客远程管理.exe
4936	刺客远程管理.exe
4436	mspaint.exe
4436	mspaint.exe
4436	mspaint.exe
4436	mspaint.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\刺客远程控制破解版修复免杀过传输报毒.zip
1⤵
PID:2632

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4744

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\刺客远程控制破解版修复免杀过传输报毒.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2752

C:\Users\Admin\Desktop\刺客远程管理.exe
"C:\Users\Admin\Desktop\刺客远程管理.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4936

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ico\wjj.bmp"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Pre-OS Boot

Bootkit

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1bootmgr

Path C:\Users\Admin\AppData\Local\Temp\7zE0CA6FDEC\ico\1bootmgr
Size 1KB
SHA256 ba474fd1af9876f6e50ddbbf9259bcb1754fff87d267275867bea253a8f53930
MD5 dd3d9b251ae0028ca124c1b19fc127d7
SHA1 22d236f46144cd2ba197a4f2223ba173fb70d286
SHA512 bf921868ff9d3adc26f65fa647acdbab8d1fe2a79af6e5c4ff01090def46433fa2002d5448b9fa8a4b354e750cdd8f95973de2ffa6cda9261e67538373fdc183
MD5 SHA1 SHA512

Submit Download

WINSPOOL.DRV

Path C:\Users\Admin\Desktop\WINSPOOL.DRV
Size 920KB
SHA256 f5a0cb05f5379078d7f78036e511cb54e4604bb64130efd76ebe49bbad58862d
MD5 a6bf842e6f67053bfdca833ce6f8b50c
SHA1 062010167a93aed46b24e24b6279e90bd7dce0df
SHA512 033379e9fdd8e1d63f2d883157dfffe55d11be70273dcc74eb9dacc688259108f604abad64ed9d80c978d3d39d51a6275af55fbec88985d12aa7f11c36e8d33b
SSDEEP 12288:GfW0yaYWnIaviOZXwElZQ6FH01fGONPfnOY0kw7WpG8Dt:G+BaYWIa6OZAEX/GOY09Cp3
MD5 SHA1 SHA512 SSDEEP

Submit Download

wjj.bmp

Path C:\Users\Admin\Desktop\ico\wjj.bmp
Size 1KB
SHA256 0b73d1f1fe37d0ad5babeea37342115f4069bf4fdc0372f328d18ce522b2ff39
MD5 370beadfcbcf7d4eed450082fc38120c
SHA1 823b586244bd81751cec97dd02bf7c86826b8293
SHA512 970a50782083080894ddd5454bb5fd48e6a87e86056c977c889dc0182f4d87f1e267b01c45253ffa2a5ba597d0b297aa8b9154c542e9a3e67ac2a7988234776b
MD5 SHA1 SHA512

Submit Download

刺客远程管理.exe

Path C:\Users\Admin\Desktop\刺客远程管理.exe
Size 4.0MB
SHA256 afb1e4a8f16351c79d06b942918037d8b08d4153029b800a77d4c8905abf0ad5
MD5 85a70e7b83914eee9f0cb56004f148d7
SHA1 231cf8c9c38c2fea588f822c560c5d7158ded778
SHA512 e1bc595eededd6439dd23aa8637f124920ef41442f60a2b119d52ea4dbea32e4b916d6ee5adfeb1c2532f69ebd7765d5594f805f1883be92ff48dc6e8f58a1fb
SSDEEP 98304:c6dHNkKQazyvNqkQFYV4n3y8orVxps0wWsyVaQxQfL2KS:NvzuAkQFe4nKWu8yKS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4936-142-0x0000000000400000-0x0000000000C8B000-memory.dmp

Download