blackmoon | 2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283

General

Target

2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe
Size

89KB
MD5

28d9183f17f18655ad1b77eaf006ac50
SHA1

cbcb9be8ae343f977c56f94a84e00c9b0c0e2aeb
SHA256

2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283
SHA512

4bab4b79095f2542f369c28a28ba2aade894e4740767459fd2b7749ded439e970591f14282ead29d5a533925c6b9deb3db492af2458b413d328ba049dea0b32e
SSDEEP

1536:5+4hkM3Yz8wMZhUD2XsjEQWOSkE+Ct6WKBex3GWU5FkWp+AmQwKGSZhCQbIo/tSP:dq6OLM3QasY5Ft71fqWWp+efG4hCQrq

Score

10^/10

blackmoon banker trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1728-15-0x0000000000400000-0x000000000047F000-memory.dmp	family_blackmoon
behavioral1/memory/2876-21-0x0000000000400000-0x000000000047F000-memory.dmp	family_blackmoon

Deletes itself 1 IoCs

Processes:

Syslemigoxm.exe

pid process

2876 Syslemigoxm.exe
Executes dropped EXE 1 IoCs

Processes:

Syslemigoxm.exe

pid process

2876 Syslemigoxm.exe

pid	process
2876	Syslemigoxm.exe

pid	process
2876	Syslemigoxm.exe

Loads dropped DLL 2 IoCs

Processes:

2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe

pid	process
1728	2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe
1728	2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1728-0-0x0000000000400000-0x000000000047F000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\Syslemigoxm.exe	upx
behavioral1/memory/2876-17-0x0000000000400000-0x000000000047F000-memory.dmp	upx
behavioral1/memory/1728-15-0x0000000000400000-0x000000000047F000-memory.dmp	upx
behavioral1/memory/2876-21-0x0000000000400000-0x000000000047F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exeSyslemigoxm.exe

pid	process
1728	2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe
1728	2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe
1728	2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe
1728	2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe
1728	2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe
1728	2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe
1728	2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe
1728	2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe
2876	Syslemigoxm.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe

description	pid	process	target process
PID 1728 wrote to memory of 2876	1728	2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe	Syslemigoxm.exe
PID 1728 wrote to memory of 2876	1728	2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe	Syslemigoxm.exe
PID 1728 wrote to memory of 2876	1728	2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe	Syslemigoxm.exe
PID 1728 wrote to memory of 2876	1728	2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe	Syslemigoxm.exe

C:\Users\Admin\AppData\Local\Temp\2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe
"C:\Users\Admin\AppData\Local\Temp\2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1728

C:\Users\Admin\AppData\Local\Temp\Syslemigoxm.exe
"C:\Users\Admin\AppData\Local\Temp\Syslemigoxm.exe"
2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2876

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Syslemigoxm.exe
Filesize
89KB

MD5
b6dd599dda3155766fa7436764e50742

SHA1
bfc289389a21217ae6782fcf3fb3d67b34139487

SHA256
ea19921c0daeefa5e3ac9f20c28558c8ac8cd0623f2c1f72c0b38839505d8a93

SHA512
4f3e657d9379552d2781211fc9e9f8f5439cde2cf8724b646b02078fb64d8a3b1d18640d5e165c6feb6a288f6df0c3febc76704ee14ec424628dc986784a4cd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpath.ini
Filesize
102B

MD5
e12f446f7b76cde0207d70b8101680d9

SHA1
b1469a6c47bca4e58822bf9d8b9b600fc4a7bcbd

SHA256
b89d6fbf4ff59f005da19a408357820be88ddc847461923f13bbfc994b615d58

SHA512
d98dfc57a3b4cd3e884e6a4f76865b353a404b820d0642dc31e7bbcf951f5ca5a22ae0114a30a2d0410c96ed1d0836e3ab25ac2b42aec92fb7ed061db81b64a0

Download Submit
memory/1728-0-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1728-16-0x0000000003790000-0x000000000380F000-memory.dmp

Filesize
508KB

Download
memory/1728-15-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2876-17-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2876-21-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads