blackmoon | 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200

General

Target

657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
Size

8.4MB
MD5

65144756960be44e2260648ca49df210
SHA1

913aeeeb2f6cdf68561cd092d467437072f73e63
SHA256

657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200
SHA512

b56a13a10bd36c98f1d7f16702b72fe04acb65417c2442c9965dde550deadf00ec0675fc18dd8e74aa30bb693a392aade00978f99ea1b9d8db63178af2980984
SSDEEP

196608:PYPDPyklrNDbtXRd6SdJNJ63ahuoo2/2rZpd3GAA29gp4DVZkK5lp9CmUlXMAkK:gPDPnlFbN6yj63ahXo2/0wAABmViQD9s

Score

10^/10

blackmoon aspackv2 banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 8 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4900-2-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/4900-3-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/4900-1-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/3384-18-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/4900-20-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/3384-17-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/3384-19-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/3384-49-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\¡øÕÙ»½Ö®Íõ¡ø\34553657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

34553657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe

pid process

3384 34553657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe

pid	process
3384	34553657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe

description	ioc	process
File opened (read-only)	\??\G:	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
File opened (read-only)	\??\M:	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
File opened (read-only)	\??\N:	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
File opened (read-only)	\??\Q:	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
File opened (read-only)	\??\R:	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
File opened (read-only)	\??\B:	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
File opened (read-only)	\??\J:	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
File opened (read-only)	\??\L:	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
File opened (read-only)	\??\P:	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
File opened (read-only)	\??\T:	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
File opened (read-only)	\??\U:	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
File opened (read-only)	\??\Y:	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
File opened (read-only)	\??\I:	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
File opened (read-only)	\??\W:	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
File opened (read-only)	\??\Z:	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
File opened (read-only)	\??\S:	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
File opened (read-only)	\??\E:	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
File opened (read-only)	\??\H:	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
File opened (read-only)	\??\K:	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
File opened (read-only)	\??\O:	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
File opened (read-only)	\??\V:	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
File opened (read-only)	\??\X:	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
File opened (read-only)	\??\A:	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe34553657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe

pid	process
4900	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
4900	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
4900	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
3384	34553657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
3384	34553657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
3384	34553657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe

description	pid	process	target process
PID 4900 wrote to memory of 3384	4900	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe	34553657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
PID 4900 wrote to memory of 3384	4900	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe	34553657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
PID 4900 wrote to memory of 3384	4900	657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe	34553657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe

C:\Users\Admin\AppData\Local\Temp\657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
"C:\Users\Admin\AppData\Local\Temp\657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4900

C:\¡øÕÙ»½Ö®Íõ¡ø\34553657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
C:\¡øÕÙ»½Ö®Íõ¡ø\34553657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3384

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\37580bfefc69c62994d251e06595ab2f.txt
Filesize
16B

MD5
3e4b53ef7d0e2479c653dd524f972755

SHA1
8e647d625bc76a27b88ce9269101b5779e736382

SHA256
cf82ff3f0a400843276265abe3e1431bdc9f5bbe0d4182137e282e8926fe0991

SHA512
5d26848c05fcd48009829e3fef59151d9e61e02c64a2a937884bb58644517fa0e15b1bbd339abadfc5a248ffbff61516414e597797e6e4e907f62a4d8cf642e0

Download Submit
C:\¡øÕÙ»½Ö®Íõ¡ø\34553657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
Filesize
8.4MB

MD5
65144756960be44e2260648ca49df210

SHA1
913aeeeb2f6cdf68561cd092d467437072f73e63

SHA256
657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200

SHA512
b56a13a10bd36c98f1d7f16702b72fe04acb65417c2442c9965dde550deadf00ec0675fc18dd8e74aa30bb693a392aade00978f99ea1b9d8db63178af2980984

Download Submit
memory/3384-49-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/3384-19-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/3384-17-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/3384-18-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/4900-7-0x0000000003C80000-0x0000000003C81000-memory.dmp

Filesize
4KB

Download
memory/4900-0-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/4900-8-0x0000000003B10000-0x0000000003B11000-memory.dmp

Filesize
4KB

Download
memory/4900-20-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/4900-9-0x0000000003CD0000-0x0000000003CD1000-memory.dmp

Filesize
4KB

Download
memory/4900-1-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/4900-3-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/4900-2-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads