blackmoon | 20ea940feda93df13c7cfee9e7b9945a1648fd0a9af70ff901f42c223c897074

Analysis

max time kernel
92s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 04:03

Target

20ea940feda93df13c7cfee9e7b9945a1648fd0a9af70ff901f42c223c897074.exe
Size

15.8MB
MD5

97c0091261c438ec7ea0f772e1e23365
SHA1

b8b46ba0cecc7e2c82f886e32465dae5f85b46cf
SHA256

20ea940feda93df13c7cfee9e7b9945a1648fd0a9af70ff901f42c223c897074
SHA512

939db98a2a6eda2ce22dbfabda8db025b9add95ec443fc052ffbc2a2e10bf2e8cbfea476c61f3fa88d562179cedf9819f86f0042ccbc11cc40d74889580d4a36
SSDEEP

393216:zfC/m7R7ow2tqWLhPrXW6bqs63g82j0IFH/gOaGgz0:zH7R+EWLhjW6bqVM0MfxP

Score

10^/10

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3964-1-0x0000000010000000-0x000000001003C000-memory.dmp	family_blackmoon
behavioral2/memory/3964-0-0x0000000010000000-0x000000001003C000-memory.dmp	family_blackmoon
behavioral2/memory/3964-7-0x0000000010000000-0x000000001003C000-memory.dmp	family_blackmoon
behavioral2/memory/3964-6-0x0000000010000000-0x000000001003C000-memory.dmp	family_blackmoon
behavioral2/memory/3964-11-0x0000000076900000-0x00000000769F0000-memory.dmp	family_blackmoon

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

20ea940feda93df13c7cfee9e7b9945a1648fd0a9af70ff901f42c223c897074.exe

description ioc process

File opened (read-only) \??\E: 20ea940feda93df13c7cfee9e7b9945a1648fd0a9af70ff901f42c223c897074.exe

description	ioc	process
File opened (read-only)	\??\E:	20ea940feda93df13c7cfee9e7b9945a1648fd0a9af70ff901f42c223c897074.exe

C:\Users\Admin\AppData\Local\Temp\20ea940feda93df13c7cfee9e7b9945a1648fd0a9af70ff901f42c223c897074.exe
"C:\Users\Admin\AppData\Local\Temp\20ea940feda93df13c7cfee9e7b9945a1648fd0a9af70ff901f42c223c897074.exe"
1⤵
- Enumerates connected drives
PID:3964

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/3964-1-0x0000000010000000-0x000000001003C000-memory.dmp

Filesize
240KB

Download
memory/3964-0-0x0000000010000000-0x000000001003C000-memory.dmp

Filesize
240KB

Download
memory/3964-7-0x0000000010000000-0x000000001003C000-memory.dmp

Filesize
240KB

Download
memory/3964-6-0x0000000010000000-0x000000001003C000-memory.dmp

Filesize
240KB

Download
memory/3964-5-0x0000000000400000-0x0000000002DB8000-memory.dmp

Filesize
41.7MB

Download
memory/3964-11-0x0000000076900000-0x00000000769F0000-memory.dmp

Filesize
960KB

Download
memory/3964-15-0x0000000076900000-0x00000000769F0000-memory.dmp

Filesize
960KB

Download
memory/3964-14-0x0000000076900000-0x00000000769F0000-memory.dmp

Filesize
960KB

Download
memory/3964-13-0x0000000076900000-0x00000000769F0000-memory.dmp

Filesize
960KB

Download
memory/3964-12-0x0000000076900000-0x00000000769F0000-memory.dmp

Filesize
960KB

Download
memory/3964-10-0x0000000076920000-0x0000000076921000-memory.dmp

Filesize
4KB

Download
memory/3964-16-0x0000000000400000-0x0000000002DB8000-memory.dmp

Filesize
41.7MB

Download
memory/3964-18-0x0000000076900000-0x00000000769F0000-memory.dmp

Filesize
960KB

Download
memory/3964-19-0x0000000076900000-0x00000000769F0000-memory.dmp

Filesize
960KB

Download
memory/3964-21-0x0000000076900000-0x00000000769F0000-memory.dmp

Filesize
960KB

Download
memory/3964-20-0x0000000000400000-0x0000000002DB8000-memory.dmp

Filesize
41.7MB

Download