blackmoon | 56774aa36cdb1bab6be96de4eee298ab0c50505fdeab096936a2b57ba9721f7c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56774aa36cdb1bab6be96de4eee298ab0c50505fdeab096936a2b57ba9721f7c.exe
Size

289KB
MD5

f7b6917b7df066450c41bef30efe7c0c
SHA1

5daaa7449b6d0c0a57d11593c1dfffdf4d335212
SHA256

56774aa36cdb1bab6be96de4eee298ab0c50505fdeab096936a2b57ba9721f7c
SHA512

74f33ef1e57327878b166f428cef6834217e602f5908c8b2e03dfd78dd20084750f95d00dcd40d0a35c7dbae75c5248ff63cb0bc5c366134d89f046cb530c74f
SSDEEP

6144:8Ij0jF9Q7otUWOgfC3rBffXhHTQ6dhqvydUoDlOuMMNMa+H4WoS:8I4j/dtUI67BffRHZDvKoBR9moS

Score

10^/10

blackmoon banker persistence trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4288-6-0x0000000000400000-0x00000000004F3000-memory.dmp	family_blackmoon

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

56774aa36cdb1bab6be96de4eee298ab0c50505fdeab096936a2b57ba9721f7c.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\56774aa36cdb1bab6be96de4eee298ab0c50505fdeab096936a2b57ba9721f7c.exe	56774aa36cdb1bab6be96de4eee298ab0c50505fdeab096936a2b57ba9721f7c.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\56774AA36CDB1BAB6BE96DE4EEE298AB0C50505FDEAB096936A2B57BA9721F7C.EXE	56774aa36cdb1bab6be96de4eee298ab0c50505fdeab096936a2b57ba9721f7c.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4288-0-0x0000000000400000-0x00000000004F3000-memory.dmp	upx
behavioral2/memory/4288-6-0x0000000000400000-0x00000000004F3000-memory.dmp	upx

Modifies Control Panel 3 IoCs

evasion

Processes:

56774aa36cdb1bab6be96de4eee298ab0c50505fdeab096936a2b57ba9721f7c.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop	56774aa36cdb1bab6be96de4eee298ab0c50505fdeab096936a2b57ba9721f7c.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\LanguageConfiguration	56774aa36cdb1bab6be96de4eee298ab0c50505fdeab096936a2b57ba9721f7c.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION	56774aa36cdb1bab6be96de4eee298ab0c50505fdeab096936a2b57ba9721f7c.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

56774aa36cdb1bab6be96de4eee298ab0c50505fdeab096936a2b57ba9721f7c.exe

description	pid	process
Token: SeBackupPrivilege	4288	56774aa36cdb1bab6be96de4eee298ab0c50505fdeab096936a2b57ba9721f7c.exe
Token: SeRestorePrivilege	4288	56774aa36cdb1bab6be96de4eee298ab0c50505fdeab096936a2b57ba9721f7c.exe

C:\Users\Admin\AppData\Local\Temp\56774aa36cdb1bab6be96de4eee298ab0c50505fdeab096936a2b57ba9721f7c.exe
"C:\Users\Admin\AppData\Local\Temp\56774aa36cdb1bab6be96de4eee298ab0c50505fdeab096936a2b57ba9721f7c.exe"
1⤵
- Sets file execution options in registry
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:4288

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4288-0-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4288-1-0x000000006F550000-0x000000006F560000-memory.dmp

Filesize
64KB

Download
memory/4288-4-0x0000000077563000-0x0000000077564000-memory.dmp

Filesize
4KB

Download
memory/4288-3-0x0000000077562000-0x0000000077563000-memory.dmp

Filesize
4KB

Download
memory/4288-2-0x00000000022B0000-0x00000000022BA000-memory.dmp

Filesize
40KB

Download
memory/4288-6-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download