blackmoon | 49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383

General

Target

49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
Size

12.2MB
MD5

56329633b5fd7357375c5e0b0336bbac
SHA1

d0b4e7ad431fcbaf89cafe93fba7665f1cf680fa
SHA256

49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383
SHA512

323056798c89a8017cef0d683be3d437b666a876572f6161080b8cc979b85923292b8061fcaf193bee82b72b002470efda7ef0e8128491bf21c7f11fb85a767c
SSDEEP

393216:gPDPKz1odC523LhAvxnIpwt+nnZn1wWN2ajmD:Yiz1R523La5IprnneD

Score

10^/10

blackmoon aspackv2 banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 8 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2468-1-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/2468-0-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/2468-2-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/2468-17-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/2816-18-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/2816-19-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/2816-20-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/2816-49-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\9SFåÐÒ£»ðÁú\1347849ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

1347849ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe

pid process

2816 1347849ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe

pid	process
2816	1347849ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe

description	ioc	process
File opened (read-only)	\??\U:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\V:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\X:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\L:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\O:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\Y:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\Q:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\W:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\J:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\K:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\R:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\T:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\Z:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\A:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\H:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\G:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\I:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\M:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\N:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\P:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\S:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\B:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
File opened (read-only)	\??\E:	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe1347849ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe

pid	process
2468	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
2468	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
2468	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
2816	1347849ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
2816	1347849ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
2816	1347849ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe

description	pid	process	target process
PID 2468 wrote to memory of 2816	2468	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe	1347849ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
PID 2468 wrote to memory of 2816	2468	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe	1347849ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
PID 2468 wrote to memory of 2816	2468	49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe	1347849ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe

C:\Users\Admin\AppData\Local\Temp\49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
"C:\Users\Admin\AppData\Local\Temp\49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468

C:\9SFåÐÒ£»ðÁú\1347849ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
C:\9SFåÐÒ£»ðÁú\1347849ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4048,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:8
1⤵
PID:2780

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\9SFåÐÒ£»ðÁú\1347849ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383.exe
Filesize
12.2MB

MD5
56329633b5fd7357375c5e0b0336bbac

SHA1
d0b4e7ad431fcbaf89cafe93fba7665f1cf680fa

SHA256
49ff964ef5b82c2010b84856a20d479ff8f0ad40d8d840ee8418b30617f63383

SHA512
323056798c89a8017cef0d683be3d437b666a876572f6161080b8cc979b85923292b8061fcaf193bee82b72b002470efda7ef0e8128491bf21c7f11fb85a767c

Download Submit
C:\Users\Admin\AppData\Local\Temp\df61bc42229084eb1b95e2150f128a84.txt
Filesize
15B

MD5
0a162858c5d5bf7f1e3f976c3582c495

SHA1
ed3b62f44424e0e8a0aa43dd97ccdd25dbfc845d

SHA256
f34d303677f27569137b9692d0b990ecc83ff1731f7d8e0223ca3d1a4c33ab22

SHA512
c2be9ff454ff3bced93efd93c0d282b6d51170ccadafd2c5a31833f9f6297f6f1c69d1ba9be58e910d670cc5b3c2cd7a26c9885aa8379f134641b1f0fe2e9fbf

Download Submit
memory/2468-7-0x0000000003B30000-0x0000000003B31000-memory.dmp

Filesize
4KB

Download
memory/2468-3-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2468-9-0x0000000003B40000-0x0000000003B41000-memory.dmp

Filesize
4KB

Download
memory/2468-8-0x0000000003B10000-0x0000000003B11000-memory.dmp

Filesize
4KB

Download
memory/2468-1-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2468-2-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2468-17-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2468-0-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2816-18-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2816-19-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2816-20-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/2816-49-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads