blackmoon | 69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451

General

Target

69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
Size

14.1MB
MD5

cc8f5cc1f9e35b75435a113dedb09209
SHA1

fa7486c38da1a941668f5c556a8a839c26c05adc
SHA256

69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451
SHA512

65d569e6bbf1abb12513f17b418871703179a2609c1f6430ffbbed16c6fa8f18f80dc17f45435b3dcf8d5c39be292dff685539d2a3f6aa7aa6d5dadecc7ff68e
SSDEEP

393216:gPDPqLpGNvPEkXhMjL/ADCWOmbAFlXRLpnjWy:Y8pGNEkXM/ADCvmb2XhpZ

Score

10^/10

blackmoon aspackv2 banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 19 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1556-2-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/1556-1-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/1556-3-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/1556-8-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/1556-9-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/1556-10-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/1556-11-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/1556-12-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/1556-20-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2656-22-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2656-23-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/1556-24-0x000000000B040000-0x000000000B566000-memory.dmp	family_blackmoon
behavioral1/memory/2656-21-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2656-25-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2656-29-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2656-30-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2656-32-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2656-59-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2656-62-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\×îÇ¿³ÁÄ¬[VDY]\1656269ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

1656269ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe

pid process

2656 1656269ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
Loads dropped DLL 1 IoCs

Processes:

69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe

pid process

1556 69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe

pid	process
2656	1656269ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe

description	ioc	process
File opened (read-only)	\??\P:	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
File opened (read-only)	\??\Q:	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
File opened (read-only)	\??\T:	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
File opened (read-only)	\??\V:	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
File opened (read-only)	\??\E:	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
File opened (read-only)	\??\H:	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
File opened (read-only)	\??\R:	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
File opened (read-only)	\??\U:	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
File opened (read-only)	\??\W:	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
File opened (read-only)	\??\Z:	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
File opened (read-only)	\??\G:	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
File opened (read-only)	\??\I:	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
File opened (read-only)	\??\M:	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
File opened (read-only)	\??\O:	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
File opened (read-only)	\??\S:	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
File opened (read-only)	\??\X:	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
File opened (read-only)	\??\A:	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
File opened (read-only)	\??\B:	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
File opened (read-only)	\??\L:	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
File opened (read-only)	\??\N:	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
File opened (read-only)	\??\Y:	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
File opened (read-only)	\??\J:	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
File opened (read-only)	\??\K:	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

1656269ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	1656269ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe1656269ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe

pid	process
1556	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
1556	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
1556	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
2656	1656269ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
2656	1656269ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
2656	1656269ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe

description	pid	process	target process
PID 1556 wrote to memory of 2656	1556	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe	1656269ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
PID 1556 wrote to memory of 2656	1556	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe	1656269ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
PID 1556 wrote to memory of 2656	1556	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe	1656269ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
PID 1556 wrote to memory of 2656	1556	69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe	1656269ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe

C:\Users\Admin\AppData\Local\Temp\69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
"C:\Users\Admin\AppData\Local\Temp\69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1556

C:\×îÇ¿³ÁÄ¬[VDY]\1656269ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
C:\×îÇ¿³ÁÄ¬[VDY]\1656269ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2656

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\38f1fcb70ecc2fc8cd38d1e5a88ad0b8.txt
Filesize
17B

MD5
7b740ecb0a254ad8e9f5b63fb299d808

SHA1
c34c1d86c6177db08109dd9025d3fab7685fc6aa

SHA256
b15985344e0c14bdb3cb77f59b5b09e23e1df1ff1e62b42fba06bc4ce722cf80

SHA512
118c0f66cdfdb798ae6284d4482de5552654d99c0741ad28fe359ae3471ff87c12746de8a5b66fbc4ab1218178d665f67231e40d0f2923fbaa0160c5d1463732

Download Submit
\×îÇ¿³ÁÄ¬[VDY]\1656269ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451.exe
Filesize
14.1MB

MD5
cc8f5cc1f9e35b75435a113dedb09209

SHA1
fa7486c38da1a941668f5c556a8a839c26c05adc

SHA256
69ca74fa24104737c068fef20052631d255588850f59c542d154e72dcb57b451

SHA512
65d569e6bbf1abb12513f17b418871703179a2609c1f6430ffbbed16c6fa8f18f80dc17f45435b3dcf8d5c39be292dff685539d2a3f6aa7aa6d5dadecc7ff68e

Download Submit
memory/1556-8-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/1556-24-0x000000000B040000-0x000000000B566000-memory.dmp

Filesize
5.1MB

Download
memory/1556-7-0x000000000091E000-0x000000000091F000-memory.dmp

Filesize
4KB

Download
memory/1556-0-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/1556-9-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/1556-10-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/1556-11-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/1556-12-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/1556-1-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/1556-20-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/1556-2-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/1556-3-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2656-23-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2656-21-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2656-25-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2656-29-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2656-30-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2656-32-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2656-22-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2656-59-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2656-62-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads