blackmoon | d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5

General

Target

d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5
Size

6.4MB
Sample

240520-dz9yzsac5s
MD5

9285ae62b4ce7e9d87a915fd62dfd031
SHA1

5704c99b6fe70fb74480f8261c441109c26d7753
SHA256

d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5
SHA512

8b513989b8851d5b13dc639c0e8022849e027cc35609b20fca7f52f36cb56472c6e6ebf119b8bb21dcae065172bc31e37e8a46f60a7d167c73ac088ea1ff46d6
SSDEEP

98304:T/WXTBJYaVmknGzZr+H3O5SEPFtmOb9G1u5v/nZVnivsAl0kroSCa:KXTYimknGzwH3OgEPH39JX/nivPli

Score

10^/10

Malware Config

Targets

- Target
  
  d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5
- Size
  
  6.4MB
- MD5
  
  9285ae62b4ce7e9d87a915fd62dfd031
- SHA1
  
  5704c99b6fe70fb74480f8261c441109c26d7753
- SHA256
  
  d9a7aa911667b23254b680fb901356dd18b24a336b22d4df51d5124e111c5ce5
- SHA512
  
  8b513989b8851d5b13dc639c0e8022849e027cc35609b20fca7f52f36cb56472c6e6ebf119b8bb21dcae065172bc31e37e8a46f60a7d167c73ac088ea1ff46d6
- SSDEEP
  
  98304:T/WXTBJYaVmknGzZr+H3O5SEPFtmOb9G1u5v/nZVnivsAl0kroSCa:KXTYimknGzwH3OgEPH39JX/nivPli
Score

10^/10

blackmoon mimikatz xmrig banker discovery evasion execution miner persistence trojan upx
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Disables service(s)
  evasion execution
- Mimikatz
  mimikatz is an open source tool to dump credentials on Windows.
  mimikatz
- Suspicious use of NtCreateUserProcessOtherParentProcess
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Contacts a large (28089) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- UPX dump on OEP (original entry point)
- XMRig Miner payload
  miner
- mimikatz is an open source tool to dump credentials on Windows
- Drops file in Drivers directory
- Sets file execution options in registry
  persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Creates a Windows Service
  persistence
- Drops file in System32 directory
behavioral1 behavioral2