blackmoon | 4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 08:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499.exe
Size

5.5MB
MD5

602371a144a5b0bc0313f25d467e81bf
SHA1

8fc32c0d1dbbf9511e96db08d842c89dc3551398
SHA256

4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499
SHA512

9a884cec66e7ab212dd055dd54624cadfa45f3089f4f082a3d692634ccc7f4c3715e88e7138f1b746671439c5658df276f9afca221ad4de2a82562e8f7ec57b5
SSDEEP

98304:xV2BpGSXTTHz4JBAUZLrHvkrQ2rRETNJGdIeC9HlXr2G3J:HSXTDz4JVHHvkrQ2rREhJGdIeOhr2GZ

Score

10^/10

blackmoon banker bootkit persistence trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1368-0-0x0000000000400000-0x0000000000980A00-memory.dmp	family_blackmoon
behavioral1/memory/1368-15-0x0000000000400000-0x0000000000980A00-memory.dmp	family_blackmoon
behavioral1/memory/1368-16-0x0000000000400000-0x0000000000980A00-memory.dmp	family_blackmoon
behavioral1/memory/1368-20-0x0000000000400000-0x0000000000980A00-memory.dmp	family_blackmoon

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1368-1-0x0000000010000000-0x0000000010019000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499.exe

description ioc process

File opened for modification \??\PhysicalDrive0 4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499.exe
Drops file in System32 directory 1 IoCs

Processes:

4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499.exe

description ioc process

File created C:\Windows\SysWOW64\Dult.dll 4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499.exe

pid process

1368 4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Dult.dll	4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499.exe

description	pid	process
Token: SeDebugPrivilege	1368	4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499.exe
Token: SeDebugPrivilege	1368	4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499.exe
Token: SeDebugPrivilege	1368	4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499.exe
Token: 1	1368	4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499.exe
Token: SeDebugPrivilege	1368	4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499.exe

pid	process
1368	4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499.exe
1368	4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499.exe

C:\Users\Admin\AppData\Local\Temp\4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499.exe
"C:\Users\Admin\AppData\Local\Temp\4fcc4a8faeecc1838cc405c39366575ad35f21153be5cc65c8dd005cd4190499.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1368

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-0-0x0000000000400000-0x0000000000980A00-memory.dmp

Filesize
5.5MB

Download
memory/1368-3-0x0000000001190000-0x0000000001711000-memory.dmp

Filesize
5.5MB

Download
memory/1368-1-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/1368-7-0x0000000001190000-0x0000000001711000-memory.dmp

Filesize
5.5MB

Download
memory/1368-14-0x0000000001190000-0x0000000001711000-memory.dmp

Filesize
5.5MB

Download
memory/1368-15-0x0000000000400000-0x0000000000980A00-memory.dmp

Filesize
5.5MB

Download
memory/1368-16-0x0000000000400000-0x0000000000980A00-memory.dmp

Filesize
5.5MB

Download
memory/1368-17-0x0000000001190000-0x0000000001711000-memory.dmp

Filesize
5.5MB

Download
memory/1368-18-0x0000000001190000-0x0000000001711000-memory.dmp

Filesize
5.5MB

Download
memory/1368-19-0x0000000001190000-0x0000000001711000-memory.dmp

Filesize
5.5MB

Download
memory/1368-20-0x0000000000400000-0x0000000000980A00-memory.dmp

Filesize
5.5MB

Download