Malware Analysis Report

2025-08-11 00:57

Sample ID 240518-b1mhzaeb4x
Target a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6
SHA256 a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6
Tags
blackmoon banker trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6

Threat Level: Known bad

The file a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6 was found to be: Known bad.

Malicious Activity Summary

blackmoon banker trojan

Detect Blackmoon payload

Blackmoon family

Blackmoon, KrBanker

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-18 01:36

Signatures

Blackmoon family

blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-18 01:36

Reported

2024-05-18 01:39

Platform

win7-20240508-en

Max time kernel

148s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe

"C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe"

C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe

"C:\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 i2.tietuku.com udp

Files

\Users\Admin\AppData\Local\Temp\Syslemyzmki.exe

MD5 8a01a9b4f6c118ff7fb6dad6b52a5449
SHA1 265014515a667487085a29aea8f44808f8510c63
SHA256 3cc7fd9fc46d28d6e81e901400c3f4ca0be70b06b2331fc5c54173797988bfb8
SHA512 54b0165c81730e9f26b10eac40b8ad6ae5ca97969e7bb9c743fe51c6f54af785cba67ad09ef30c291f7c5c7af96f09d30db0d7fc090c5ad36ab8d66bf9bedfe4

C:\Users\Admin\AppData\Local\Temp\lpath.ini

MD5 006bf0320e353a01bfe26f4c485efc10
SHA1 450d23111c59bae7d462e6b6ad9594fe2be532f3
SHA256 37b04c5798505268aac74ae4ed31bde8fba5c9bd2c7e64c5f5717c07bac7a038
SHA512 692e9911379b993c1d14f1ba6a81d3c97052ac8969ac942af1b4064030d1eb28482f0ec88d0008968852ed686bf49c18960771ea2421dc8135977ca874ef55d6

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-18 01:36

Reported

2024-05-18 01:39

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe

"C:\Users\Admin\AppData\Local\Temp\a7c8eca6195903d4128789cbfddba7294205dc6646e8da2334d2e410111dfbd6.exe"

C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe

"C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 i2.tietuku.com udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 41.173.79.40.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\Syslemzquhv.exe

MD5 e57839c2086a13706def624da824cfb5
SHA1 e54cd9b80c2129ac33a8a40fbb2caa9cab5d92f3
SHA256 d8595c70f76cc286e6713b0f635ebd276026bc082788c302f18de72f3b5e5540
SHA512 437111b2bd27eefff6313775da2fe8fcb0db1753dad0f96e74cbb7338469d6ba4be166fec421af09402213a7b27493c7f79a0b6f3f144ce4eedc25f969230e93

C:\Users\Admin\AppData\Local\Temp\lpath.ini

MD5 006bf0320e353a01bfe26f4c485efc10
SHA1 450d23111c59bae7d462e6b6ad9594fe2be532f3
SHA256 37b04c5798505268aac74ae4ed31bde8fba5c9bd2c7e64c5f5717c07bac7a038
SHA512 692e9911379b993c1d14f1ba6a81d3c97052ac8969ac942af1b4064030d1eb28482f0ec88d0008968852ed686bf49c18960771ea2421dc8135977ca874ef55d6