blackmoon | 7eb9866b77a10eb8e656d5e38bc64459a79a07de62c3e08ffbd3c2c800f102a1

General

Target

63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe
Size

559KB
MD5

63ffefeb9f2c1f25436267ac7cb6f105
SHA1

76752ae6b2dd49d82bef018650eec9961e02b4d5
SHA256

7eb9866b77a10eb8e656d5e38bc64459a79a07de62c3e08ffbd3c2c800f102a1
SHA512

96ca76ec040f3d549505bf7e0b9ba5e1d880b8eaaaddc02711dfd06c3efdb48fa383089ea0d426e2c27b700552e1f3b6e783a1d6821aa4942bff2b55218dbe93
SSDEEP

12288:Hvq+NSK+dopSnfAHCjRszSNz21AQ4Oc6Rrvvf3V:D+QhitcUz21N73Rzvf

Score

10^/10

blackmoon gh0strat banker persistence rat trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2412-1-0x0000000000400000-0x00000000004B3000-memory.dmp	family_blackmoon
behavioral1/memory/2412-2-0x0000000000400000-0x00000000004B3000-memory.dmp	family_blackmoon
behavioral1/memory/2412-32-0x0000000000400000-0x00000000004B3000-memory.dmp	family_blackmoon

Gh0st RAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2196-53-0x0000000010000000-0x0000000010046000-memory.dmp	family_gh0strat
behavioral1/memory/2196-55-0x0000000010000000-0x0000000010046000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2720 cmd.exe
Executes dropped EXE 2 IoCs

Processes:

03v7Ho8I.exe03v7Ho8Ipl.exe

pid process

2976 03v7Ho8I.exe
2772 03v7Ho8Ipl.exe

pid	process
2720	cmd.exe

pid	process
2976	03v7Ho8I.exe
2772	03v7Ho8Ipl.exe

Loads dropped DLL 4 IoCs

Processes:

63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe

pid	process
2412	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe
2412	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe
2412	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe
2412	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

03v7Ho8I.exe03v7Ho8Ipl.exeCalc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DEECE6B0C1A4 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\03v7Ho8I\\03v7Ho8I.exe"	03v7Ho8I.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TGeruce = "C:\\Users\\Admin\\AppData\\Local\\Temp\\03v7Ho8Ipl\\03v7Ho8Ipl.exe"	03v7Ho8Ipl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\4A75ABD3 = "C:\\Windows\\4A75ABD3\\svchsot.exe"	Calc.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

03v7Ho8Ipl.exe

description pid process target process

PID 2772 set thread context of 2196 2772 03v7Ho8Ipl.exe Calc.exe
Drops file in Windows directory 2 IoCs

Processes:

Calc.exe

description ioc process

File created C:\Windows\4A75ABD3\svchsot.exe Calc.exe
File opened for modification C:\Windows\4A75ABD3\svchsot.exe Calc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

description	pid	process	target process
PID 2772 set thread context of 2196	2772	03v7Ho8Ipl.exe	Calc.exe

description	ioc	process
File created	C:\Windows\4A75ABD3\svchsot.exe	Calc.exe
File opened for modification	C:\Windows\4A75ABD3\svchsot.exe	Calc.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

03v7Ho8Ipl.exeCalc.exe

pid	process
2772	03v7Ho8Ipl.exe
2772	03v7Ho8Ipl.exe
2772	03v7Ho8Ipl.exe
2772	03v7Ho8Ipl.exe
2772	03v7Ho8Ipl.exe
2772	03v7Ho8Ipl.exe
2772	03v7Ho8Ipl.exe
2772	03v7Ho8Ipl.exe
2772	03v7Ho8Ipl.exe
2196	Calc.exe
2196	Calc.exe
2196	Calc.exe
2196	Calc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Calc.exe

description pid process

Token: SeDebugPrivilege 2196 Calc.exe
Token: SeDebugPrivilege 2196 Calc.exe

description	pid	process
Token: SeDebugPrivilege	2196	Calc.exe
Token: SeDebugPrivilege	2196	Calc.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe03v7Ho8Ipl.exeCalc.exenet.exe

description	pid	process	target process
PID 2412 wrote to memory of 2976	2412	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe	03v7Ho8I.exe
PID 2412 wrote to memory of 2976	2412	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe	03v7Ho8I.exe
PID 2412 wrote to memory of 2976	2412	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe	03v7Ho8I.exe
PID 2412 wrote to memory of 2976	2412	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe	03v7Ho8I.exe
PID 2412 wrote to memory of 2772	2412	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe	03v7Ho8Ipl.exe
PID 2412 wrote to memory of 2772	2412	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe	03v7Ho8Ipl.exe
PID 2412 wrote to memory of 2772	2412	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe	03v7Ho8Ipl.exe
PID 2412 wrote to memory of 2772	2412	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe	03v7Ho8Ipl.exe
PID 2412 wrote to memory of 2720	2412	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe	cmd.exe
PID 2412 wrote to memory of 2720	2412	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe	cmd.exe
PID 2412 wrote to memory of 2720	2412	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe	cmd.exe
PID 2412 wrote to memory of 2720	2412	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe	cmd.exe
PID 2772 wrote to memory of 2196	2772	03v7Ho8Ipl.exe	Calc.exe
PID 2772 wrote to memory of 2196	2772	03v7Ho8Ipl.exe	Calc.exe
PID 2772 wrote to memory of 2196	2772	03v7Ho8Ipl.exe	Calc.exe
PID 2772 wrote to memory of 2196	2772	03v7Ho8Ipl.exe	Calc.exe
PID 2772 wrote to memory of 2196	2772	03v7Ho8Ipl.exe	Calc.exe
PID 2772 wrote to memory of 2196	2772	03v7Ho8Ipl.exe	Calc.exe
PID 2772 wrote to memory of 2196	2772	03v7Ho8Ipl.exe	Calc.exe
PID 2772 wrote to memory of 2196	2772	03v7Ho8Ipl.exe	Calc.exe
PID 2772 wrote to memory of 2196	2772	03v7Ho8Ipl.exe	Calc.exe
PID 2772 wrote to memory of 2196	2772	03v7Ho8Ipl.exe	Calc.exe
PID 2196 wrote to memory of 2980	2196	Calc.exe	net.exe
PID 2196 wrote to memory of 2980	2196	Calc.exe	net.exe
PID 2196 wrote to memory of 2980	2196	Calc.exe	net.exe
PID 2196 wrote to memory of 2980	2196	Calc.exe	net.exe
PID 2980 wrote to memory of 348	2980	net.exe	net1.exe
PID 2980 wrote to memory of 348	2980	net.exe	net1.exe
PID 2980 wrote to memory of 348	2980	net.exe	net1.exe
PID 2980 wrote to memory of 348	2980	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2412

C:\Users\Admin\AppData\Local\Temp\03v7Ho8I\03v7Ho8I.exe
"C:\Users\Admin\AppData\Local\Temp\03v7Ho8I\03v7Ho8I.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2976

C:\Users\Admin\AppData\Local\Temp\03v7Ho8Ipl\03v7Ho8Ipl.exe
"C:\Users\Admin\AppData\Local\Temp\03v7Ho8Ipl\03v7Ho8Ipl.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2772

C:\Windows\SysWOW64\Calc.exe
C:\Windows\System32\Calc.exe
3⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196

C:\Windows\SysWOW64\net.exe
net start "Task Scheduler"
4⤵
- Suspicious use of WriteProcessMemory
PID:2980

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start "Task Scheduler"
5⤵
PID:348

C:\Windows\SysWOW64\cmd.exe
cmd /c del "C:\Users\Admin\AppData\Local\Temp\63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe"
2⤵
- Deletes itself
PID:2720

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\03v7Ho8I\03v7Ho8I.exe
Filesize
309KB

MD5
aef72c464e2e5570e6147eda060fa9db

SHA1
19581e546dc01c1b5fc18bbdfffb233af258a090

SHA256
2bfdee2290252c62e94feb41f45e93f841305051e1f615019c4c1f9654eb088f

SHA512
0e152642952a0cbf1a760362b043b35ec5264adf8ee4ee0be9ff6500f2ecee0f0df3c16b9740a68a6f76d2ae3468f85905e2c72f7111e6043b62e6213e326ab2

Download Submit
\Users\Admin\AppData\Local\Temp\03v7Ho8Ipl\03v7Ho8Ipl.exe
Filesize
171KB

MD5
7c18e0859797a81a4e3174b0f26278c2

SHA1
29f7d030cdd0aa732d04ce150fd249d4c4c433d7

SHA256
0021025405670877709e3af0e9896d25d1163a2dfba82333e152491e0088f965

SHA512
d1c72d053385ed17bce97f659a0d3ed4af2e5d9c17c6eaa4b723864a08a1bf2ba88fd36b36e9109147b26b4eef4e9525a7c799da7bc6a9b909ff5a9409536855

Download Submit
memory/2196-47-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2196-35-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2196-37-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2196-33-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2196-40-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2196-55-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/2196-53-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/2196-51-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/2196-43-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2196-50-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2412-12-0x0000000002AC0000-0x0000000002B4A000-memory.dmp

Filesize
552KB

Download
memory/2412-32-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2412-0-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2412-22-0x0000000002AC0000-0x0000000002B0B000-memory.dmp

Filesize
300KB

Download
memory/2412-11-0x0000000002AC0000-0x0000000002B4A000-memory.dmp

Filesize
552KB

Download
memory/2412-2-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2412-1-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2772-29-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2772-30-0x0000000000030000-0x0000000000032000-memory.dmp

Filesize
8KB

Download
memory/2772-59-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2772-61-0x0000000000030000-0x0000000000032000-memory.dmp

Filesize
8KB

Download
memory/2976-17-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2976-16-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2976-14-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads