blackmoon | 60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901

General

Target

60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
Size

15.4MB
MD5

6c383722ad1c17ca56ec68423b58164f
SHA1

770a9217fd95d2fb5346f46d114ba9bf7dc75cb3
SHA256

60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901
SHA512

0e3f9afc8d9983816d56bb93cb1a03c024e83aa3ead68d6611867570bdd127d4c2ac2b8c00c1d29332004de15098dee4ea1cae7c6202cf2c17d595b419b4296e
SSDEEP

393216:gPDPKFpGNvnodC5/3LhAvxvkKL0+8zFf32YJzW1aJ:YSFpGZR5/3LaVkoYh2YJW10

Score

10^/10

blackmoon aspackv2 banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 8 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2684-2-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/2684-1-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/2684-3-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/2548-19-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/2548-18-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/2684-17-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/2548-20-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/2548-49-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\9SFÍò½çÄ§Ö÷\3367460afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

3367460afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe

pid process

2548 3367460afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe

pid	process
2548	3367460afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe

description	ioc	process
File opened (read-only)	\??\G:	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
File opened (read-only)	\??\H:	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
File opened (read-only)	\??\L:	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
File opened (read-only)	\??\R:	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
File opened (read-only)	\??\M:	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
File opened (read-only)	\??\P:	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
File opened (read-only)	\??\Y:	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
File opened (read-only)	\??\A:	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
File opened (read-only)	\??\T:	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
File opened (read-only)	\??\Z:	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
File opened (read-only)	\??\B:	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
File opened (read-only)	\??\E:	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
File opened (read-only)	\??\I:	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
File opened (read-only)	\??\J:	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
File opened (read-only)	\??\K:	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
File opened (read-only)	\??\N:	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
File opened (read-only)	\??\O:	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
File opened (read-only)	\??\Q:	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
File opened (read-only)	\??\S:	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
File opened (read-only)	\??\U:	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
File opened (read-only)	\??\V:	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
File opened (read-only)	\??\W:	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
File opened (read-only)	\??\X:	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe3367460afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe

pid	process
2684	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
2684	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
2684	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
2548	3367460afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
2548	3367460afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
2548	3367460afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe

description	pid	process	target process
PID 2684 wrote to memory of 2548	2684	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe	3367460afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
PID 2684 wrote to memory of 2548	2684	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe	3367460afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
PID 2684 wrote to memory of 2548	2684	60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe	3367460afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe

C:\Users\Admin\AppData\Local\Temp\60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
"C:\Users\Admin\AppData\Local\Temp\60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684

C:\9SFÍò½çÄ§Ö÷\3367460afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
C:\9SFÍò½çÄ§Ö÷\3367460afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\9SFÍò½çÄ§Ö÷\3367460afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901.exe

Filesize
15.4MB

MD5
6c383722ad1c17ca56ec68423b58164f

SHA1
770a9217fd95d2fb5346f46d114ba9bf7dc75cb3

SHA256
60afa1da090d4ae091c03c92cae5e2f59753bd3236968bccc7998efd1f651901

SHA512
0e3f9afc8d9983816d56bb93cb1a03c024e83aa3ead68d6611867570bdd127d4c2ac2b8c00c1d29332004de15098dee4ea1cae7c6202cf2c17d595b419b4296e

Download Submit
C:\Users\Admin\AppData\Local\Temp\12dbfc28a8a34a98a84a0db77a8f2134.txt

Filesize
15B

MD5
bc39f4faa60ec6b3a3fc283a05984747

SHA1
c5c8d1faabdc13e1f7db6399d36ec9cf48ccd45a

SHA256
e7acdccd5bc382a74ea1b9a5da5a4b76cc268df250d27f29b5967c0dbbccc4ca

SHA512
100af08b64c2aa1b2021be03707a8d4e1f462a39b8b31da38c860f9d5e513f5ee43535b5425d2e2070ff2df52d61515166f58ce97b0ecb56aad4a8cc5e58b343

Download Submit
memory/2548-19-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2548-49-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2548-20-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2548-18-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2684-7-0x0000000003C80000-0x0000000003C81000-memory.dmp

Filesize
4KB

Download
memory/2684-0-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2684-8-0x0000000003A10000-0x0000000003A11000-memory.dmp

Filesize
4KB

Download
memory/2684-17-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2684-9-0x0000000003C90000-0x0000000003C91000-memory.dmp

Filesize
4KB

Download
memory/2684-3-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2684-1-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2684-2-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads