blackmoon | 7eb9866b77a10eb8e656d5e38bc64459a79a07de62c3e08ffbd3c2c800f102a1

General

Target

63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe
Size

559KB
MD5

63ffefeb9f2c1f25436267ac7cb6f105
SHA1

76752ae6b2dd49d82bef018650eec9961e02b4d5
SHA256

7eb9866b77a10eb8e656d5e38bc64459a79a07de62c3e08ffbd3c2c800f102a1
SHA512

96ca76ec040f3d549505bf7e0b9ba5e1d880b8eaaaddc02711dfd06c3efdb48fa383089ea0d426e2c27b700552e1f3b6e783a1d6821aa4942bff2b55218dbe93
SSDEEP

12288:Hvq+NSK+dopSnfAHCjRszSNz21AQ4Oc6Rrvvf3V:D+QhitcUz21N73Rzvf

Score

10^/10

blackmoon gh0strat banker persistence rat trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4172-1-0x0000000000400000-0x00000000004B3000-memory.dmp	family_blackmoon
behavioral2/memory/4172-2-0x0000000000400000-0x00000000004B3000-memory.dmp	family_blackmoon
behavioral2/memory/4172-31-0x0000000000400000-0x00000000004B3000-memory.dmp	family_blackmoon

Gh0st RAT payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1592-40-0x0000000010000000-0x0000000010046000-memory.dmp	family_gh0strat
behavioral2/memory/1592-42-0x0000000010000000-0x0000000010046000-memory.dmp	family_gh0strat
behavioral2/memory/1592-43-0x0000000010000000-0x0000000010046000-memory.dmp	family_gh0strat
behavioral2/memory/1592-44-0x0000000010000000-0x0000000010046000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

Processes:

889c5MS1.exe889c5MS1AN.exe

pid process

4432 889c5MS1.exe
1452 889c5MS1AN.exe

pid	process
4432	889c5MS1.exe
1452	889c5MS1AN.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

889c5MS1AN.exeCalc.exe889c5MS1.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TGeruce = "C:\\Users\\Admin\\AppData\\Local\\Temp\\889c5MS1AN\\889c5MS1AN.exe"	889c5MS1AN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\4A75ABD3 = "C:\\Windows\\4A75ABD3\\svchsot.exe"	Calc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\468278FCF08E = "C:\\Users\\Admin\\AppData\\Local\\Temp\\889c5MS1\\889c5MS1.exe"	889c5MS1.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

889c5MS1AN.exe

description pid process target process

PID 1452 set thread context of 1592 1452 889c5MS1AN.exe Calc.exe
Drops file in Windows directory 2 IoCs

Processes:

Calc.exe

description ioc process

File created C:\Windows\4A75ABD3\svchsot.exe Calc.exe
File opened for modification C:\Windows\4A75ABD3\svchsot.exe Calc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

description	pid	process	target process
PID 1452 set thread context of 1592	1452	889c5MS1AN.exe	Calc.exe

description	ioc	process
File created	C:\Windows\4A75ABD3\svchsot.exe	Calc.exe
File opened for modification	C:\Windows\4A75ABD3\svchsot.exe	Calc.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

889c5MS1AN.exeCalc.exe

pid	process
1452	889c5MS1AN.exe
1452	889c5MS1AN.exe
1452	889c5MS1AN.exe
1452	889c5MS1AN.exe
1452	889c5MS1AN.exe
1452	889c5MS1AN.exe
1452	889c5MS1AN.exe
1452	889c5MS1AN.exe
1452	889c5MS1AN.exe
1452	889c5MS1AN.exe
1452	889c5MS1AN.exe
1452	889c5MS1AN.exe
1452	889c5MS1AN.exe
1452	889c5MS1AN.exe
1452	889c5MS1AN.exe
1452	889c5MS1AN.exe
1452	889c5MS1AN.exe
1452	889c5MS1AN.exe
1592	Calc.exe
1592	Calc.exe
1592	Calc.exe
1592	Calc.exe
1592	Calc.exe
1592	Calc.exe
1592	Calc.exe
1592	Calc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Calc.exe

description pid process

Token: SeDebugPrivilege 1592 Calc.exe
Token: SeDebugPrivilege 1592 Calc.exe

description	pid	process
Token: SeDebugPrivilege	1592	Calc.exe
Token: SeDebugPrivilege	1592	Calc.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe889c5MS1AN.exeCalc.exenet.exe

description	pid	process	target process
PID 4172 wrote to memory of 4432	4172	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe	889c5MS1.exe
PID 4172 wrote to memory of 4432	4172	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe	889c5MS1.exe
PID 4172 wrote to memory of 4432	4172	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe	889c5MS1.exe
PID 4172 wrote to memory of 1452	4172	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe	889c5MS1AN.exe
PID 4172 wrote to memory of 1452	4172	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe	889c5MS1AN.exe
PID 4172 wrote to memory of 1452	4172	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe	889c5MS1AN.exe
PID 4172 wrote to memory of 2116	4172	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe	cmd.exe
PID 4172 wrote to memory of 2116	4172	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe	cmd.exe
PID 4172 wrote to memory of 2116	4172	63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe	cmd.exe
PID 1452 wrote to memory of 1592	1452	889c5MS1AN.exe	Calc.exe
PID 1452 wrote to memory of 1592	1452	889c5MS1AN.exe	Calc.exe
PID 1452 wrote to memory of 1592	1452	889c5MS1AN.exe	Calc.exe
PID 1452 wrote to memory of 1592	1452	889c5MS1AN.exe	Calc.exe
PID 1452 wrote to memory of 1592	1452	889c5MS1AN.exe	Calc.exe
PID 1452 wrote to memory of 1592	1452	889c5MS1AN.exe	Calc.exe
PID 1452 wrote to memory of 1592	1452	889c5MS1AN.exe	Calc.exe
PID 1452 wrote to memory of 1592	1452	889c5MS1AN.exe	Calc.exe
PID 1452 wrote to memory of 1592	1452	889c5MS1AN.exe	Calc.exe
PID 1592 wrote to memory of 3836	1592	Calc.exe	net.exe
PID 1592 wrote to memory of 3836	1592	Calc.exe	net.exe
PID 1592 wrote to memory of 3836	1592	Calc.exe	net.exe
PID 3836 wrote to memory of 1600	3836	net.exe	net1.exe
PID 3836 wrote to memory of 1600	3836	net.exe	net1.exe
PID 3836 wrote to memory of 1600	3836	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4172

C:\Users\Admin\AppData\Local\Temp\889c5MS1\889c5MS1.exe
"C:\Users\Admin\AppData\Local\Temp\889c5MS1\889c5MS1.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4432

C:\Users\Admin\AppData\Local\Temp\889c5MS1AN\889c5MS1AN.exe
"C:\Users\Admin\AppData\Local\Temp\889c5MS1AN\889c5MS1AN.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\SysWOW64\Calc.exe
C:\Windows\System32\Calc.exe
3⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1592

C:\Windows\SysWOW64\net.exe
net start "Task Scheduler"
4⤵
- Suspicious use of WriteProcessMemory
PID:3836

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start "Task Scheduler"
5⤵
PID:1600

C:\Windows\SysWOW64\cmd.exe
cmd /c del "C:\Users\Admin\AppData\Local\Temp\63ffefeb9f2c1f25436267ac7cb6f105_JaffaCakes118.exe"
2⤵
PID:2116

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\889c5MS1AN\889c5MS1AN.exe
Filesize
171KB

MD5
7c18e0859797a81a4e3174b0f26278c2

SHA1
29f7d030cdd0aa732d04ce150fd249d4c4c433d7

SHA256
0021025405670877709e3af0e9896d25d1163a2dfba82333e152491e0088f965

SHA512
d1c72d053385ed17bce97f659a0d3ed4af2e5d9c17c6eaa4b723864a08a1bf2ba88fd36b36e9109147b26b4eef4e9525a7c799da7bc6a9b909ff5a9409536855

Download Submit
C:\Users\Admin\AppData\Local\Temp\889c5MS1\889c5MS1.exe
Filesize
309KB

MD5
aef72c464e2e5570e6147eda060fa9db

SHA1
19581e546dc01c1b5fc18bbdfffb233af258a090

SHA256
2bfdee2290252c62e94feb41f45e93f841305051e1f615019c4c1f9654eb088f

SHA512
0e152642952a0cbf1a760362b043b35ec5264adf8ee4ee0be9ff6500f2ecee0f0df3c16b9740a68a6f76d2ae3468f85905e2c72f7111e6043b62e6213e326ab2

Download Submit
memory/1452-50-0x00000000001D0000-0x00000000001D2000-memory.dmp

Filesize
8KB

Download
memory/1452-48-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1452-29-0x00000000001D0000-0x00000000001D2000-memory.dmp

Filesize
8KB

Download
memory/1452-28-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1592-42-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/1592-38-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/1592-51-0x0000000001330000-0x0000000001331000-memory.dmp

Filesize
4KB

Download
memory/1592-44-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/1592-43-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/1592-33-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1592-34-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1592-32-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1592-37-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1592-40-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/1592-41-0x0000000001330000-0x0000000001331000-memory.dmp

Filesize
4KB

Download
memory/4172-0-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4172-31-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4172-2-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4172-1-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4432-16-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4432-14-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4432-15-0x0000000000620000-0x0000000000623000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads