blackmoon | 9db9ff622a13ce2f91f10aaf7ea77bacb045a2350ef93382766166270f3c813a

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-05-2024 15:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe
Size

431KB
MD5

e2b858b0b40d3d998778e17d00787b10
SHA1

22850999a548a5982a2c145ae74c1a0dc3e42a87
SHA256

9db9ff622a13ce2f91f10aaf7ea77bacb045a2350ef93382766166270f3c813a
SHA512

71323ac9b182eb077eee63586ab70fa5ffd12f6397adbdde983c95d00477d3fb2f2e952281fcec7f901a876cce50477189f886a45bb5dc8839292f835c63a520
SSDEEP

6144:cT5J63Fm3b7yOE7Hvpu5CaGi4mUf95TtC4uP2scqAH:c4Fm3b7yOAHNar4mUf9lJ82scqAH

Score

10^/10

blackmoon banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\Systemjjbpn.exe	family_blackmoon

Deletes itself 1 IoCs

Processes:

Systemjjbpn.exe

pid process

2576 Systemjjbpn.exe
Executes dropped EXE 1 IoCs

Processes:

Systemjjbpn.exe

pid process

2576 Systemjjbpn.exe
Loads dropped DLL 2 IoCs

Processes:

e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe

pid process

2512 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe
2512 e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2576	Systemjjbpn.exe

pid	process
2576	Systemjjbpn.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exeSystemjjbpn.exe

pid	process
2512	e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe
2512	e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe
2512	e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe
2512	e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe
2512	e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe
2512	e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe
2512	e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe
2512	e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe
2576	Systemjjbpn.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe

description	pid	process	target process
PID 2512 wrote to memory of 2576	2512	e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe	Systemjjbpn.exe
PID 2512 wrote to memory of 2576	2512	e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe	Systemjjbpn.exe
PID 2512 wrote to memory of 2576	2512	e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe	Systemjjbpn.exe
PID 2512 wrote to memory of 2576	2512	e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe	Systemjjbpn.exe

C:\Users\Admin\AppData\Local\Temp\e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e2b858b0b40d3d998778e17d00787b10_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2512

C:\Users\Admin\AppData\Local\Temp\Systemjjbpn.exe
"C:\Users\Admin\AppData\Local\Temp\Systemjjbpn.exe"
2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\path.ini

Filesize
85B

MD5
dd1fcfd52e099f2e2f3cb111e94bf33b

SHA1
5d333e8dfc6efb61ac9684080a4986838d3e6924

SHA256
fb4761df51040f5b4d09733d2cb70b080a7b49998424b1849f37d88dee9be143

SHA512
4f42e2b0694684435d662c26e882f3d9cc3c8bb5d5bfed420f454e699f35c64755e3acab43a18f8a97d32884c97ed24e490689644005296e0ead0da227b7242e

Download Submit
\Users\Admin\AppData\Local\Temp\Systemjjbpn.exe

Filesize
431KB

MD5
56c8ea8a78fd7955b0cf0e52fdc1f4f1

SHA1
b33a3151222f65c579f3182c6a3cf774e1ad9071

SHA256
881aaf0f46a35a08195ca316b38d380b64287183ff7128e86715fff887236af8

SHA512
2e1fc6ae4f8299b744cce67cfb16102806c42fad477300974adb6164aec9b4e4bf87add6169827494f5d281f18c1ccf6fb17262a8c9021af04553d926fb792ca

Download Submit