blackmoon | 4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f

General

Target

4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
Size

15.7MB
MD5

608677ece7519dd4e098a5b654f0f1dd
SHA1

2c20383cbecee5e2b69264cdbbb2cf88b70d20ba
SHA256

4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f
SHA512

f269e9a1387aae6a1d510476e4fd531b4c7365fdbe49fefc797d1935a98b8aafd5c14f6fe046720220c18184c1d5488bd7108832847ca7681c30cb9ca7dc7988
SSDEEP

393216:gPDPlhEFmyEfXG8odC5g3LhAvxN+I3ryKUA3f20oxtMb:Y9hEUy0R5g3LaWI7s7Zx2

Score

10^/10

blackmoon aspackv2 banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 8 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1040-1-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/1040-2-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/1040-3-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/3528-19-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/3528-18-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/1040-17-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/3528-20-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/3528-49-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\9SFÓ²ºº¹éÀ´\342254f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

342254f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe

pid process

3528 342254f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe

pid	process
3528	342254f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe

description	ioc	process
File opened (read-only)	\??\P:	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
File opened (read-only)	\??\Q:	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
File opened (read-only)	\??\R:	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
File opened (read-only)	\??\U:	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
File opened (read-only)	\??\V:	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
File opened (read-only)	\??\J:	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
File opened (read-only)	\??\N:	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
File opened (read-only)	\??\L:	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
File opened (read-only)	\??\T:	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
File opened (read-only)	\??\Z:	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
File opened (read-only)	\??\A:	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
File opened (read-only)	\??\E:	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
File opened (read-only)	\??\O:	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
File opened (read-only)	\??\X:	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
File opened (read-only)	\??\Y:	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
File opened (read-only)	\??\I:	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
File opened (read-only)	\??\M:	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
File opened (read-only)	\??\H:	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
File opened (read-only)	\??\K:	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
File opened (read-only)	\??\S:	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
File opened (read-only)	\??\W:	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
File opened (read-only)	\??\B:	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
File opened (read-only)	\??\G:	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe342254f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe

pid	process
1040	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
1040	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
1040	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
3528	342254f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
3528	342254f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
3528	342254f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe

description	pid	process	target process
PID 1040 wrote to memory of 3528	1040	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe	342254f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
PID 1040 wrote to memory of 3528	1040	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe	342254f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
PID 1040 wrote to memory of 3528	1040	4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe	342254f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe

C:\Users\Admin\AppData\Local\Temp\4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
"C:\Users\Admin\AppData\Local\Temp\4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1040

C:\9SFÓ²ºº¹éÀ´\342254f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
C:\9SFÓ²ºº¹éÀ´\342254f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\9SFÓ²ºº¹éÀ´\342254f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f.exe

Filesize
15.7MB

MD5
608677ece7519dd4e098a5b654f0f1dd

SHA1
2c20383cbecee5e2b69264cdbbb2cf88b70d20ba

SHA256
4f3d11ed3437b294940ab2dae01e2ac9d9a48d4c58498ed59e2f361aac86822f

SHA512
f269e9a1387aae6a1d510476e4fd531b4c7365fdbe49fefc797d1935a98b8aafd5c14f6fe046720220c18184c1d5488bd7108832847ca7681c30cb9ca7dc7988

Download Submit
C:\Users\Admin\AppData\Local\Temp\e3f47775e6c2d409a02dfa7be83ffd4f.txt

Filesize
15B

MD5
f6ddd04260eb789809d1e45231cc2fa9

SHA1
1e600f7d76c49ba21c815ace0c71318de3c8fe27

SHA256
eb91662de8107835cb670fb4568fd1a30673ab571d341e078ca7d505d52343dc

SHA512
f8ee9cf586a18817d4fe67728bfd476cca4d26facfd83a15b7798fc6b3024406591d2f7ca176c2f6a88ecf3edde9f37f476dd36bee063dfd9fa05b8f256f9751

Download Submit
memory/1040-7-0x00000000040E0000-0x00000000040E1000-memory.dmp

Filesize
4KB

Download
memory/1040-3-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/1040-9-0x00000000040F0000-0x00000000040F1000-memory.dmp

Filesize
4KB

Download
memory/1040-8-0x0000000003C70000-0x0000000003C71000-memory.dmp

Filesize
4KB

Download
memory/1040-0-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/1040-2-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/1040-17-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/1040-1-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/3528-19-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/3528-18-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/3528-20-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/3528-49-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads