blackmoon | 94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c

General

Target

94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
Size

13.3MB
MD5

73fe097b71eaa10a8ce651cf7026db93
SHA1

ed711d0d68173869fb523eec521a50eafe097401
SHA256

94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c
SHA512

dab9d34861f5ed3fd74a15c98f5ebf01ddf2698180951057a1dfe55d8332bf91535383275ecd8e0103969cebb2e8247517f1faf55f5164493c494a5c34675253
SSDEEP

393216:3k9bzy/+6xDMmAsFqJrEHmgGqvr2FaL/g8b:L/HNXFq9jgGeKFI/Xb

Score

10^/10

blackmoon aspackv2 banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/216-9-0x0000000003A80000-0x0000000003BC0000-memory.dmp	family_blackmoon
behavioral2/memory/216-6-0x0000000003A80000-0x0000000003BC0000-memory.dmp	family_blackmoon
behavioral2/memory/2464-32-0x0000000003AB0000-0x0000000003BF0000-memory.dmp	family_blackmoon
behavioral2/memory/2464-30-0x0000000003AB0000-0x0000000003BF0000-memory.dmp	family_blackmoon

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\µÀÌì¸´¹Å\94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	aspack_v212_v242

Deletes itself 1 IoCs

Processes:

94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

pid process

2384 94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

pid	process
2384	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

Executes dropped EXE 2 IoCs

Processes:

94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

pid	process
2464	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
2384	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

description	ioc	process
File opened (read-only)	\??\H:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\K:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\M:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\P:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\R:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\S:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\U:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\X:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\Y:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\A:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\B:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\J:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\N:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\T:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\W:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\Z:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\L:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\a:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\E:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\G:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\I:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\O:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\Q:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\V:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

description	pid	process
Token: SeDebugPrivilege	1588	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
Token: SeDebugPrivilege	2384	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

pid	process
1588	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
1588	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
2384	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
2384	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

C:\Users\Admin\AppData\Local\Temp\94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
"C:\Users\Admin\AppData\Local\Temp\94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:216

C:\Users\Admin\AppData\Local\Temp\94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
C:\Users\Admin\AppData\Local\Temp\94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1588

C:\µÀÌì¸´¹Å\94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
"C:\µÀÌì¸´¹Å\94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe" 1588 "C:\Users\Admin\AppData\Local\Temp\94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464

C:\µÀÌì¸´¹Å\94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
C:\µÀÌì¸´¹Å\94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
4⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2384

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lsm.tmp
Filesize
80B

MD5
463add58265e10186a741e3531f628c5

SHA1
faffb51fe27dc160a3ad545b577ffa7969346b51

SHA256
f87545551ad6ead943b4d393b5bd3cc6ea8e780cdb0b98115545bda7fe739aac

SHA512
927eb6de03aa3ffe33a87143ae948f5b145ac602a2612af36dfdb677cebe43f9b8c1c99e7693e77819e1e85e0b5b8122f7cbb28d2e3eb04ae708277cb0c90d3b

Download Submit
C:\µÀÌì¸´¹Å\94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
Filesize
13.3MB

MD5
73fe097b71eaa10a8ce651cf7026db93

SHA1
ed711d0d68173869fb523eec521a50eafe097401

SHA256
94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c

SHA512
dab9d34861f5ed3fd74a15c98f5ebf01ddf2698180951057a1dfe55d8332bf91535383275ecd8e0103969cebb2e8247517f1faf55f5164493c494a5c34675253

Download Submit
memory/216-2-0x0000000000400000-0x0000000001E47000-memory.dmp

Filesize
26.3MB

Download
memory/216-4-0x0000000000400000-0x0000000001E47000-memory.dmp

Filesize
26.3MB

Download
memory/216-5-0x0000000003A00000-0x0000000003A01000-memory.dmp

Filesize
4KB

Download
memory/216-7-0x000000007FD70000-0x000000007FDF0000-memory.dmp

Filesize
512KB

Download
memory/216-10-0x0000000003CB0000-0x0000000003D1C000-memory.dmp

Filesize
432KB

Download
memory/216-3-0x0000000000400000-0x0000000001E47000-memory.dmp

Filesize
26.3MB

Download
memory/216-1-0x0000000000400000-0x0000000001E47000-memory.dmp

Filesize
26.3MB

Download
memory/216-0-0x0000000000400000-0x0000000001E47000-memory.dmp

Filesize
26.3MB

Download
memory/216-13-0x0000000000400000-0x0000000001E47000-memory.dmp

Filesize
26.3MB

Download
memory/216-6-0x0000000003A80000-0x0000000003BC0000-memory.dmp

Filesize
1.2MB

Download
memory/216-18-0x0000000003CB0000-0x0000000003D1C000-memory.dmp

Filesize
432KB

Download
memory/216-9-0x0000000003A80000-0x0000000003BC0000-memory.dmp

Filesize
1.2MB

Download
memory/1588-11-0x00000000001D0000-0x00000000001E0000-memory.dmp

Filesize
64KB

Download
memory/1588-12-0x00000000001D0000-0x00000000001E0000-memory.dmp

Filesize
64KB

Download
memory/1588-17-0x0000000000400000-0x0000000000A0F000-memory.dmp

Filesize
6.1MB

Download
memory/1588-24-0x0000000000400000-0x0000000000A0F000-memory.dmp

Filesize
6.1MB

Download
memory/1588-16-0x0000000000400000-0x0000000000A0F000-memory.dmp

Filesize
6.1MB

Download
memory/1588-15-0x0000000001E02000-0x0000000001E03000-memory.dmp

Filesize
4KB

Download
memory/2384-41-0x0000000000400000-0x0000000000A0F000-memory.dmp

Filesize
6.1MB

Download
memory/2464-29-0x0000000000400000-0x0000000001E47000-memory.dmp

Filesize
26.3MB

Download
memory/2464-28-0x0000000000400000-0x0000000001E47000-memory.dmp

Filesize
26.3MB

Download
memory/2464-27-0x0000000000400000-0x0000000001E47000-memory.dmp

Filesize
26.3MB

Download
memory/2464-32-0x0000000003AB0000-0x0000000003BF0000-memory.dmp

Filesize
1.2MB

Download
memory/2464-30-0x0000000003AB0000-0x0000000003BF0000-memory.dmp

Filesize
1.2MB

Download
memory/2464-26-0x0000000000400000-0x0000000001E47000-memory.dmp

Filesize
26.3MB

Download
memory/2464-39-0x0000000000400000-0x0000000001E47000-memory.dmp

Filesize
26.3MB

Download
memory/2464-25-0x0000000000400000-0x0000000001E47000-memory.dmp

Filesize
26.3MB

Download

description	pid	process	target process
PID 216 wrote to memory of 1588	216	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 216 wrote to memory of 1588	216	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 216 wrote to memory of 1588	216	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 216 wrote to memory of 1588	216	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 216 wrote to memory of 1588	216	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 216 wrote to memory of 1588	216	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 216 wrote to memory of 1588	216	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 216 wrote to memory of 1588	216	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 216 wrote to memory of 1588	216	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 216 wrote to memory of 1588	216	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 216 wrote to memory of 1588	216	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 1588 wrote to memory of 2464	1588	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 1588 wrote to memory of 2464	1588	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 1588 wrote to memory of 2464	1588	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2464 wrote to memory of 2384	2464	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2464 wrote to memory of 2384	2464	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2464 wrote to memory of 2384	2464	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2464 wrote to memory of 2384	2464	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2464 wrote to memory of 2384	2464	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2464 wrote to memory of 2384	2464	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2464 wrote to memory of 2384	2464	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2464 wrote to memory of 2384	2464	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2464 wrote to memory of 2384	2464	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2464 wrote to memory of 2384	2464	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2464 wrote to memory of 2384	2464	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads