blackmoon | 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46

General

Target

11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
Size

13.8MB
MD5

55fd7441106c7daec15c1b5a79cea60c
SHA1

14d882909f0997f03617b68b47ad70891be88f12
SHA256

11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46
SHA512

033216c70076f5ec7cd0a78aea635826fc9efece01ff2e47698c806758b1da63ef771777ec6d9ceec8f1c62b6e3e955e8c6a8686139b5a54fe35421dcf927c12
SSDEEP

393216:gPDP5EFmyEfXGMXOCNYUl0sW2w+77OTsXdzIO9b5uU:YxEUy0XO1I/Isd9AU

Score

10^/10

blackmoon aspackv2 banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 16 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1320-2-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/1320-3-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/1320-1-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/1320-8-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/1320-9-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/1320-10-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2708-23-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2708-24-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2708-25-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2708-22-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/1320-21-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2708-29-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2708-30-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2708-32-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2708-57-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2708-59-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\1.76ÐùÔ¯¡¾HBÎ¢¶Ë¡¿\1884911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

1884911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe

pid process

2708 1884911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
Loads dropped DLL 1 IoCs

Processes:

11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe

pid process

1320 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe

pid	process
2708	1884911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe

description	ioc	process
File opened (read-only)	\??\B:	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
File opened (read-only)	\??\E:	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
File opened (read-only)	\??\J:	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
File opened (read-only)	\??\S:	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
File opened (read-only)	\??\V:	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
File opened (read-only)	\??\Y:	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
File opened (read-only)	\??\G:	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
File opened (read-only)	\??\L:	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
File opened (read-only)	\??\O:	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
File opened (read-only)	\??\T:	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
File opened (read-only)	\??\M:	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
File opened (read-only)	\??\N:	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
File opened (read-only)	\??\P:	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
File opened (read-only)	\??\R:	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
File opened (read-only)	\??\W:	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
File opened (read-only)	\??\X:	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
File opened (read-only)	\??\Z:	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
File opened (read-only)	\??\A:	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
File opened (read-only)	\??\H:	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
File opened (read-only)	\??\I:	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
File opened (read-only)	\??\K:	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
File opened (read-only)	\??\Q:	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
File opened (read-only)	\??\U:	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

1884911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	1884911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe1884911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe

pid	process
1320	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
1320	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
1320	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
2708	1884911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
2708	1884911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
2708	1884911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe

description	pid	process	target process
PID 1320 wrote to memory of 2708	1320	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe	1884911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
PID 1320 wrote to memory of 2708	1320	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe	1884911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
PID 1320 wrote to memory of 2708	1320	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe	1884911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
PID 1320 wrote to memory of 2708	1320	11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe	1884911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe

C:\Users\Admin\AppData\Local\Temp\11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
"C:\Users\Admin\AppData\Local\Temp\11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320

C:\1.76ÐùÔ¯¡¾HBÎ¢¶Ë¡¿\1884911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
C:\1.76ÐùÔ¯¡¾HBÎ¢¶Ë¡¿\1884911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2708

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f5eb8834eaf390c911a56e08cecc315a.txt
Filesize
22B

MD5
4bbb6d351502075537991f3c30672925

SHA1
0752f7de39539b6c13b906f73a6e07c7cb58e3f2

SHA256
5a5c82dbb91de09b8ebbe22de9830d51c3c598b132625b4491ca31707f220f6a

SHA512
b8c4c7cebbbb4874f0ac9e3c184abbd968f231f8cef444a1068da3a140d3168940ab2ddacaaf4b654968a30e45006994e7e5efe05d40ea857c3b529bad7eddcb

Download Submit
\1.76ÐùÔ¯¡¾HBÎ¢¶Ë¡¿\1884911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
Filesize
13.8MB

MD5
55fd7441106c7daec15c1b5a79cea60c

SHA1
14d882909f0997f03617b68b47ad70891be88f12

SHA256
11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46

SHA512
033216c70076f5ec7cd0a78aea635826fc9efece01ff2e47698c806758b1da63ef771777ec6d9ceec8f1c62b6e3e955e8c6a8686139b5a54fe35421dcf927c12

Download Submit
memory/1320-21-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/1320-2-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/1320-3-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/1320-1-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/1320-7-0x000000000091E000-0x000000000091F000-memory.dmp

Filesize
4KB

Download
memory/1320-8-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/1320-9-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/1320-10-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/1320-0-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/1320-19-0x0000000006A60000-0x0000000006F86000-memory.dmp

Filesize
5.1MB

Download
memory/2708-24-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2708-22-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2708-25-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2708-29-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2708-30-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2708-32-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2708-23-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2708-57-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2708-59-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads