blackmoon | c86b89cc6492930514b8ae3ec7c9daf8e121598094adee97c78bb883dd9dccf0

General

Target

c86b89cc6492930514b8ae3ec7c9daf8e121598094adee97c78bb883dd9dccf0.exe
Size

11.6MB
MD5

58b618c282892c058f1763158565e58b
SHA1

fe6f24f9ffe31b35b8800fe14a1caebac5b225e3
SHA256

c86b89cc6492930514b8ae3ec7c9daf8e121598094adee97c78bb883dd9dccf0
SHA512

eee434f6890ea722259e8b758b3944190f53a0ddd2f246d75482390fe0bafe34f28927c8bf75d93b468efe6439ea409f148f4cdedf6d88cc691a66b95182e477
SSDEEP

196608:jwgKTiEsbyVJVCpBHY8RchssmUBVPLn+YSLgOQQabVmkO1oVmHRan7e1:8b8yVTCNGFmUjnWC5FOPxcC1

Score

10^/10

blackmoon banker trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 8 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2112-36-0x0000000000400000-0x0000000001855000-memory.dmp	family_blackmoon
behavioral1/memory/2112-39-0x0000000000400000-0x0000000001855000-memory.dmp	family_blackmoon
behavioral1/memory/2112-40-0x0000000000400000-0x0000000001855000-memory.dmp	family_blackmoon
behavioral1/memory/2112-41-0x0000000000400000-0x0000000001855000-memory.dmp	family_blackmoon
behavioral1/memory/2112-42-0x0000000000400000-0x0000000001855000-memory.dmp	family_blackmoon
behavioral1/memory/2112-43-0x0000000000400000-0x0000000001855000-memory.dmp	family_blackmoon
behavioral1/memory/2112-44-0x0000000000400000-0x0000000001855000-memory.dmp	family_blackmoon
behavioral1/memory/2112-46-0x0000000000400000-0x0000000001855000-memory.dmp	family_blackmoon

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2112-45-0x00000000034D0000-0x0000000003506000-memory.dmp	upx
behavioral1/memory/2112-47-0x00000000034D0000-0x0000000003506000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

c86b89cc6492930514b8ae3ec7c9daf8e121598094adee97c78bb883dd9dccf0.exe

pid process

2112 c86b89cc6492930514b8ae3ec7c9daf8e121598094adee97c78bb883dd9dccf0.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

c86b89cc6492930514b8ae3ec7c9daf8e121598094adee97c78bb883dd9dccf0.exe

pid	process
2112	c86b89cc6492930514b8ae3ec7c9daf8e121598094adee97c78bb883dd9dccf0.exe
2112	c86b89cc6492930514b8ae3ec7c9daf8e121598094adee97c78bb883dd9dccf0.exe

C:\Users\Admin\AppData\Local\Temp\c86b89cc6492930514b8ae3ec7c9daf8e121598094adee97c78bb883dd9dccf0.exe
"C:\Users\Admin\AppData\Local\Temp\c86b89cc6492930514b8ae3ec7c9daf8e121598094adee97c78bb883dd9dccf0.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2112

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2112-36-0x0000000000400000-0x0000000001855000-memory.dmp

Filesize
20.3MB

Download
memory/2112-38-0x00000000006E1000-0x0000000000CC2000-memory.dmp

Filesize
5.9MB

Download
memory/2112-34-0x0000000001890000-0x0000000001891000-memory.dmp

Filesize
4KB

Download
memory/2112-32-0x0000000001890000-0x0000000001891000-memory.dmp

Filesize
4KB

Download
memory/2112-29-0x0000000001880000-0x0000000001881000-memory.dmp

Filesize
4KB

Download
memory/2112-27-0x0000000001880000-0x0000000001881000-memory.dmp

Filesize
4KB

Download
memory/2112-24-0x0000000001870000-0x0000000001871000-memory.dmp

Filesize
4KB

Download
memory/2112-22-0x0000000001870000-0x0000000001871000-memory.dmp

Filesize
4KB

Download
memory/2112-19-0x0000000001860000-0x0000000001861000-memory.dmp

Filesize
4KB

Download
memory/2112-17-0x0000000001860000-0x0000000001861000-memory.dmp

Filesize
4KB

Download
memory/2112-14-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2112-12-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2112-10-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2112-9-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2112-7-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2112-5-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2112-4-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2112-2-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2112-0-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2112-39-0x0000000000400000-0x0000000001855000-memory.dmp

Filesize
20.3MB

Download
memory/2112-40-0x0000000000400000-0x0000000001855000-memory.dmp

Filesize
20.3MB

Download
memory/2112-41-0x0000000000400000-0x0000000001855000-memory.dmp

Filesize
20.3MB

Download
memory/2112-42-0x0000000000400000-0x0000000001855000-memory.dmp

Filesize
20.3MB

Download
memory/2112-43-0x0000000000400000-0x0000000001855000-memory.dmp

Filesize
20.3MB

Download
memory/2112-44-0x0000000000400000-0x0000000001855000-memory.dmp

Filesize
20.3MB

Download
memory/2112-45-0x00000000034D0000-0x0000000003506000-memory.dmp

Filesize
216KB

Download
memory/2112-46-0x0000000000400000-0x0000000001855000-memory.dmp

Filesize
20.3MB

Download
memory/2112-47-0x00000000034D0000-0x0000000003506000-memory.dmp

Filesize
216KB

Download
memory/2112-48-0x00000000006E1000-0x0000000000CC2000-memory.dmp

Filesize
5.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads