blackmoon | faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe
Size

287KB
MD5

a10420c0e62d533524339d8a8e5fa8c7
SHA1

b474bfc351e19a0174192e0fa3fe5b59a3ae3349
SHA256

faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2
SHA512

a0eef4471af693b5075ecc079f080e56b1e8cb04797186969d590d3391a5ccc97e925b59b04f45185124d292b1053c83ac351c12e9df64c8d317e312aa4121ae
SSDEEP

6144:mjGwSZAiQfBZAiF5FEca4jx1kEVfp7trTg1nV/3OnQJVrALo2hiZ/2b:mjGwShaLEvm1ZBYF+nKWM2AZ

Score

10^/10

blackmoon banker persistence trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/428-11-0x0000000000400000-0x00000000004D6000-memory.dmp	family_blackmoon

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe	faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\FAF9B2A7A9CDE0866360F0964FFD39919262B623FEDC9E0A1784FFAB57BF1DA2.EXE	faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe

Loads dropped DLL 1 IoCs

Processes:

faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe

pid process

428 faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe

pid	process
428	faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/428-1-0x0000000000AB0000-0x0000000000ABB000-memory.dmp	upx
behavioral2/memory/428-7-0x0000000000AB0000-0x0000000000ABB000-memory.dmp	upx

Modifies Control Panel 3 IoCs

evasion

Processes:

faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop	faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\LanguageConfiguration	faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION	faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe

description	pid	process
Token: SeDebugPrivilege	428	faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe
Token: SeBackupPrivilege	428	faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe
Token: SeRestorePrivilege	428	faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe

C:\Users\Admin\AppData\Local\Temp\faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe
"C:\Users\Admin\AppData\Local\Temp\faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe"
1⤵
- Sets file execution options in registry
- Loads dropped DLL
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4404,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:8
1⤵
PID:1992

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\E-Module\gzip.dll
Filesize
29KB

MD5
8b3591965f623b219c0c528153746cab

SHA1
020961494fa0e08779b7aacf4422269935354f7d

SHA256
97ea3d99cf21123bc1aec72f9ded6a51ac659830392adfefd424eb799ab0219e

SHA512
6e547197d160c9ec13cf2384add1bb6753276e3dab97d951adba9257d6bf999720635a7b9d94a5ca8b94bdda2f25f36c5938d126bc3e46a358e1fad072132351

Download Submit
memory/428-0-0x0000000000400000-0x00000000004D6000-memory.dmp

Filesize
856KB

Download
memory/428-1-0x0000000000AB0000-0x0000000000ABB000-memory.dmp

Filesize
44KB

Download
memory/428-8-0x0000000077BD2000-0x0000000077BD3000-memory.dmp

Filesize
4KB

Download
memory/428-9-0x0000000077BD3000-0x0000000077BD4000-memory.dmp

Filesize
4KB

Download
memory/428-7-0x0000000000AB0000-0x0000000000ABB000-memory.dmp

Filesize
44KB

Download
memory/428-6-0x000000006FBC0000-0x000000006FBD0000-memory.dmp

Filesize
64KB

Download
memory/428-11-0x0000000000400000-0x00000000004D6000-memory.dmp

Filesize
856KB

Download