blackmoon | 83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908

General

Target

83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe
Size

2.8MB
MD5

b455386e89a19e05764869d5485c739f
SHA1

4bd6fa97684ba82862acf788c8bbe97310dabfe8
SHA256

83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908
SHA512

25511af7ac3a802f221eee70869583e5290a37189fbcd325499a0c50ce3b5067667a40abe45d0013ec44c992dd68b8bf8c49aad511cfbddfbc83df47cd6873a4
SSDEEP

49152:9KBbvqRaUsjrAYlhGZCFX2+Zf5svwSC95zH8wHRtP0hUyCSm5LX1EFeDIJSph8Py:SvPUWMAoCFRRsvwSC95zTHEhVCl7SFeD

Score

10^/10

blackmoon banker spyware stealer trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3420-1-0x0000000000400000-0x0000000000B07000-memory.dmp	family_blackmoon
behavioral2/memory/3420-2-0x0000000000400000-0x0000000000B07000-memory.dmp	family_blackmoon
behavioral2/memory/3420-3-0x0000000000400000-0x0000000000B07000-memory.dmp	family_blackmoon
behavioral2/memory/3420-4-0x0000000000400000-0x0000000000B07000-memory.dmp	family_blackmoon
behavioral2/memory/3420-5-0x0000000000400000-0x0000000000B07000-memory.dmp	family_blackmoon
behavioral2/memory/3420-6-0x0000000000400000-0x0000000000B07000-memory.dmp	family_blackmoon

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3420-0-0x0000000000400000-0x0000000000B07000-memory.dmp	upx
behavioral2/memory/3420-1-0x0000000000400000-0x0000000000B07000-memory.dmp	upx
behavioral2/memory/3420-2-0x0000000000400000-0x0000000000B07000-memory.dmp	upx
behavioral2/memory/3420-3-0x0000000000400000-0x0000000000B07000-memory.dmp	upx
behavioral2/memory/3420-4-0x0000000000400000-0x0000000000B07000-memory.dmp	upx
behavioral2/memory/3420-5-0x0000000000400000-0x0000000000B07000-memory.dmp	upx
behavioral2/memory/3420-6-0x0000000000400000-0x0000000000B07000-memory.dmp	upx

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe

description	ioc	process
File opened (read-only)	\??\I:	83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe
File opened (read-only)	\??\M:	83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe
File opened (read-only)	\??\N:	83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe
File opened (read-only)	\??\S:	83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe
File opened (read-only)	\??\V:	83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe
File opened (read-only)	\??\W:	83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe
File opened (read-only)	\??\Z:	83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe
File opened (read-only)	\??\B:	83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe
File opened (read-only)	\??\H:	83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe
File opened (read-only)	\??\J:	83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe
File opened (read-only)	\??\L:	83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe
File opened (read-only)	\??\O:	83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe
File opened (read-only)	\??\X:	83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe
File opened (read-only)	\??\A:	83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe
File opened (read-only)	\??\U:	83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe
File opened (read-only)	\??\K:	83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe
File opened (read-only)	\??\G:	83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe
File opened (read-only)	\??\P:	83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe
File opened (read-only)	\??\Q:	83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe
File opened (read-only)	\??\R:	83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe
File opened (read-only)	\??\T:	83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe
File opened (read-only)	\??\Y:	83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe
File opened (read-only)	\??\E:	83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe

pid	process
3420	83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe
3420	83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe

C:\Users\Admin\AppData\Local\Temp\83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe
"C:\Users\Admin\AppData\Local\Temp\83b0d5ce553a4409abf0b4f6d599b1de948eec22e674ba768ba045753ee5b908.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:3420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3420-0-0x0000000000400000-0x0000000000B07000-memory.dmp

Filesize
7.0MB

Download
memory/3420-1-0x0000000000400000-0x0000000000B07000-memory.dmp

Filesize
7.0MB

Download
memory/3420-2-0x0000000000400000-0x0000000000B07000-memory.dmp

Filesize
7.0MB

Download
memory/3420-3-0x0000000000400000-0x0000000000B07000-memory.dmp

Filesize
7.0MB

Download
memory/3420-4-0x0000000000400000-0x0000000000B07000-memory.dmp

Filesize
7.0MB

Download
memory/3420-5-0x0000000000400000-0x0000000000B07000-memory.dmp

Filesize
7.0MB

Download
memory/3420-6-0x0000000000400000-0x0000000000B07000-memory.dmp

Filesize
7.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads