blackmoon | ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2

General

Target

ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
Size

15.4MB
MD5

23f87f4db9da43225c083271aefbc337
SHA1

95e0246ad205e61045dea39617bfca2d27f317b6
SHA256

ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2
SHA512

e4813623352478ba195590a7e9c296ead59f193523dffca8197ba77fabe676500ad85e1bd9f849a2081a8776e35733f1264628545666b877bc677d14a708aa65
SSDEEP

393216:UnaetWreNcKL2Drs9LiA+S3jHRNUO0GoU/WhonaC:YcreqKik9+i3jxQhU/6onB

Score

10^/10

blackmoon aspackv2 banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 8 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3044-2-0x0000000000400000-0x0000000000927000-memory.dmp	family_blackmoon
behavioral2/memory/3044-1-0x0000000000400000-0x0000000000927000-memory.dmp	family_blackmoon
behavioral2/memory/3044-3-0x0000000000400000-0x0000000000927000-memory.dmp	family_blackmoon
behavioral2/memory/3044-18-0x0000000000400000-0x0000000000927000-memory.dmp	family_blackmoon
behavioral2/memory/1844-19-0x0000000000400000-0x0000000000927000-memory.dmp	family_blackmoon
behavioral2/memory/1844-21-0x0000000000400000-0x0000000000927000-memory.dmp	family_blackmoon
behavioral2/memory/1844-20-0x0000000000400000-0x0000000000927000-memory.dmp	family_blackmoon
behavioral2/memory/1844-50-0x0000000000400000-0x0000000000927000-memory.dmp	family_blackmoon

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\ÖîÉñ´«Ëµ\25420ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

25420ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe

pid process

1844 25420ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe

pid	process
1844	25420ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe

description	ioc	process
File opened (read-only)	\??\H:	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
File opened (read-only)	\??\O:	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
File opened (read-only)	\??\V:	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
File opened (read-only)	\??\W:	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
File opened (read-only)	\??\A:	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
File opened (read-only)	\??\G:	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
File opened (read-only)	\??\M:	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
File opened (read-only)	\??\P:	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
File opened (read-only)	\??\R:	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
File opened (read-only)	\??\Y:	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
File opened (read-only)	\??\Z:	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
File opened (read-only)	\??\E:	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
File opened (read-only)	\??\I:	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
File opened (read-only)	\??\J:	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
File opened (read-only)	\??\N:	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
File opened (read-only)	\??\Q:	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
File opened (read-only)	\??\S:	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
File opened (read-only)	\??\U:	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
File opened (read-only)	\??\B:	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
File opened (read-only)	\??\K:	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
File opened (read-only)	\??\L:	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
File opened (read-only)	\??\T:	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
File opened (read-only)	\??\X:	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe25420ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe

pid	process
3044	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
3044	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
3044	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
1844	25420ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
1844	25420ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
1844	25420ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe

description	pid	process	target process
PID 3044 wrote to memory of 1844	3044	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe	25420ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
PID 3044 wrote to memory of 1844	3044	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe	25420ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
PID 3044 wrote to memory of 1844	3044	ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe	25420ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe

C:\Users\Admin\AppData\Local\Temp\ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
"C:\Users\Admin\AppData\Local\Temp\ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044

C:\ÖîÉñ´«Ëµ\25420ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
C:\ÖîÉñ´«Ëµ\25420ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1c0dafa2764931e74179a9ab0028cc5a.txt
Filesize
12B

MD5
2018fad0d562984421a6daedc428d0ec

SHA1
f5ef2e251a75b272770ea623cdc99742a5a04a92

SHA256
ae8a77c9bca81f3d2883066984a87213b97601be540cd1a7c8fcb8f9996367ad

SHA512
4270f94bfa1c0a9e59395a7433614db127d2fcf110c218e8b73b95413b3df358f3a53f5115089e2135935ad3b0eeddc7dd92b649082d8408c867f0ba16c3a5be

Download Submit
C:\ÖîÉñ´«Ëµ\25420ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2.exe
Filesize
15.4MB

MD5
23f87f4db9da43225c083271aefbc337

SHA1
95e0246ad205e61045dea39617bfca2d27f317b6

SHA256
ac7cdfc98a9d2ba7fa4b851727156d0aee97336867fcab4a4a00a57e398fafd2

SHA512
e4813623352478ba195590a7e9c296ead59f193523dffca8197ba77fabe676500ad85e1bd9f849a2081a8776e35733f1264628545666b877bc677d14a708aa65

Download Submit
memory/1844-50-0x0000000000400000-0x0000000000927000-memory.dmp

Filesize
5.2MB

Download
memory/1844-16-0x0000000000400000-0x0000000000927000-memory.dmp

Filesize
5.2MB

Download
memory/1844-20-0x0000000000400000-0x0000000000927000-memory.dmp

Filesize
5.2MB

Download
memory/1844-21-0x0000000000400000-0x0000000000927000-memory.dmp

Filesize
5.2MB

Download
memory/1844-19-0x0000000000400000-0x0000000000927000-memory.dmp

Filesize
5.2MB

Download
memory/3044-3-0x0000000000400000-0x0000000000927000-memory.dmp

Filesize
5.2MB

Download
memory/3044-18-0x0000000000400000-0x0000000000927000-memory.dmp

Filesize
5.2MB

Download
memory/3044-7-0x0000000003FD0000-0x0000000003FD1000-memory.dmp

Filesize
4KB

Download
memory/3044-8-0x0000000003A60000-0x0000000003A61000-memory.dmp

Filesize
4KB

Download
memory/3044-9-0x0000000003FE0000-0x0000000003FE1000-memory.dmp

Filesize
4KB

Download
memory/3044-0-0x0000000000400000-0x0000000000927000-memory.dmp

Filesize
5.2MB

Download
memory/3044-1-0x0000000000400000-0x0000000000927000-memory.dmp

Filesize
5.2MB

Download
memory/3044-2-0x0000000000400000-0x0000000000927000-memory.dmp

Filesize
5.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads