blackmoon | faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe
Size

287KB
MD5

a10420c0e62d533524339d8a8e5fa8c7
SHA1

b474bfc351e19a0174192e0fa3fe5b59a3ae3349
SHA256

faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2
SHA512

a0eef4471af693b5075ecc079f080e56b1e8cb04797186969d590d3391a5ccc97e925b59b04f45185124d292b1053c83ac351c12e9df64c8d317e312aa4121ae
SSDEEP

6144:mjGwSZAiQfBZAiF5FEca4jx1kEVfp7trTg1nV/3OnQJVrALo2hiZ/2b:mjGwShaLEvm1ZBYF+nKWM2AZ

Score

10^/10

blackmoon banker persistence trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1656-8-0x0000000000400000-0x00000000004D6000-memory.dmp	family_blackmoon

Sets file execution options in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions	faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe

Loads dropped DLL 1 IoCs

Processes:

faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe

pid process

1656 faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe

pid	process
1656	faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1656-6-0x00000000001E0000-0x00000000001EB000-memory.dmp	upx
behavioral1/memory/1656-1-0x00000000001E0000-0x00000000001EB000-memory.dmp	upx

Modifies Control Panel 2 IoCs

evasion

Processes:

faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop\LanguageConfiguration	faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop	faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe

description	pid	process
Token: SeDebugPrivilege	1656	faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe
Token: SeBackupPrivilege	1656	faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe
Token: SeRestorePrivilege	1656	faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe

C:\Users\Admin\AppData\Local\Temp\faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe
"C:\Users\Admin\AppData\Local\Temp\faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe"
1⤵
- Sets file execution options in registry
- Loads dropped DLL
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:1656

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\E-Module\gzip.dll
Filesize
29KB

MD5
8b3591965f623b219c0c528153746cab

SHA1
020961494fa0e08779b7aacf4422269935354f7d

SHA256
97ea3d99cf21123bc1aec72f9ded6a51ac659830392adfefd424eb799ab0219e

SHA512
6e547197d160c9ec13cf2384add1bb6753276e3dab97d951adba9257d6bf999720635a7b9d94a5ca8b94bdda2f25f36c5938d126bc3e46a358e1fad072132351

Download Submit
memory/1656-0-0x0000000000400000-0x00000000004D6000-memory.dmp

Filesize
856KB

Download
memory/1656-5-0x000000006FB70000-0x000000006FB80000-memory.dmp

Filesize
64KB

Download
memory/1656-7-0x0000000077B90000-0x0000000077B91000-memory.dmp

Filesize
4KB

Download
memory/1656-6-0x00000000001E0000-0x00000000001EB000-memory.dmp

Filesize
44KB

Download
memory/1656-1-0x00000000001E0000-0x00000000001EB000-memory.dmp

Filesize
44KB

Download
memory/1656-8-0x0000000000400000-0x00000000004D6000-memory.dmp

Filesize
856KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads