blackmoon | 49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383

General

Target

49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
Size

12.2MB
MD5

56329633b5fd7357375c5e0b0336bbac
SHA1

d0b4e7ad431fcbaf89cafe93fba7665f1cf680fa
SHA256

49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383
SHA512

323056798c89a8017cef0d683be3d437b666a876572f6161080b8cc979b85923292b8061fcaf193bee82b72b002470efda7ef0e8128491bf21c7f11fb85a767c
SSDEEP

393216:gPDPKz1odC523LhAvxnIpwt+nnZn1wWN2ajmD:Yiz1R523La5IprnneD

Score

10^/10

blackmoon aspackv2 banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2152-1-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2152-2-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2152-3-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2152-8-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2152-11-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2152-12-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2152-10-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2152-9-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2152-21-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2568-25-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2568-24-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2568-26-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2568-30-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2568-31-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2568-33-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2568-54-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral1/memory/2568-56-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\9SFåÐÒ£»ðÁú\3689649ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

3689649ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe

pid process

2568 3689649ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
Loads dropped DLL 1 IoCs

Processes:

49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe

pid process

2152 49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe

pid	process
2568	3689649ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe

description	ioc	process
File opened (read-only)	\??\H:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\J:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\R:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\S:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\X:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\Y:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\Z:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\A:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\B:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\L:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\M:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\N:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\O:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\P:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\G:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\Q:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\U:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\E:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\I:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\K:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\T:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\V:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\W:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

3689649ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	3689649ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe3689649ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe

pid	process
2152	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
2152	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
2152	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
2568	3689649ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
2568	3689649ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
2568	3689649ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe

description	pid	process	target process
PID 2152 wrote to memory of 2568	2152	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe	3689649ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
PID 2152 wrote to memory of 2568	2152	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe	3689649ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
PID 2152 wrote to memory of 2568	2152	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe	3689649ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
PID 2152 wrote to memory of 2568	2152	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe	3689649ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe

C:\Users\Admin\AppData\Local\Temp\49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
"C:\Users\Admin\AppData\Local\Temp\49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152

C:\9SFåÐÒ£»ðÁú\3689649ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
C:\9SFåÐÒ£»ðÁú\3689649ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2568

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\df61bc42229084eb1b95e2150f128a84.txt
Filesize
15B

MD5
0a162858c5d5bf7f1e3f976c3582c495

SHA1
ed3b62f44424e0e8a0aa43dd97ccdd25dbfc845d

SHA256
f34d303677f27569137b9692d0b990ecc83ff1731f7d8e0223ca3d1a4c33ab22

SHA512
c2be9ff454ff3bced93efd93c0d282b6d51170ccadafd2c5a31833f9f6297f6f1c69d1ba9be58e910d670cc5b3c2cd7a26c9885aa8379f134641b1f0fe2e9fbf

Download Submit
\9SFåÐÒ£»ðÁú\3689649ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
Filesize
12.2MB

MD5
56329633b5fd7357375c5e0b0336bbac

SHA1
d0b4e7ad431fcbaf89cafe93fba7665f1cf680fa

SHA256
49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383

SHA512
323056798c89a8017cef0d683be3d437b666a876572f6161080b8cc979b85923292b8061fcaf193bee82b72b002470efda7ef0e8128491bf21c7f11fb85a767c

Download Submit
memory/2152-8-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2152-1-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2152-7-0x000000000091E000-0x000000000091F000-memory.dmp

Filesize
4KB

Download
memory/2152-0-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2152-11-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2152-12-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2152-10-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2152-9-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2152-2-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2152-20-0x000000000B010000-0x000000000B536000-memory.dmp

Filesize
5.1MB

Download
memory/2152-21-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2152-3-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2568-25-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2568-23-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2568-26-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2568-30-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2568-31-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2568-33-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2568-24-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2568-54-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2568-56-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads