blackmoon | fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a

General

Target

fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exe
Size

10.0MB
MD5

0f76bcc0a7de6edf80f35d4dc05e28d4
SHA1

b2e1f3e1b640089208c509329e34831404efd55e
SHA256

fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a
SHA512

eeb3485ba73db10b0bb45f125f4cee745456f2f7cd8e6419c5561ac0f79f1f359783063f341afd3a9c8a1d87b9b01dc7d749c93ea126893ba71e871ee0b4fcd9
SSDEEP

196608:QpOfjom+j8qq1USf/7+qqWRD31fqzO7P95lv77q/ANPYRuY+Ge:TV+YqqPT+aD3FqslvCI9Y

Score

10^/10

blackmoon banker trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3048-80-0x0000000000400000-0x00000000018A7000-memory.dmp	family_blackmoon
behavioral1/memory/3048-81-0x0000000000400000-0x00000000018A7000-memory.dmp	family_blackmoon
behavioral1/memory/3048-82-0x0000000000400000-0x00000000018A7000-memory.dmp	family_blackmoon

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3048-37-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3048-65-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3048-63-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3048-61-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3048-59-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3048-57-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3048-55-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3048-53-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3048-51-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3048-49-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3048-47-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3048-45-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3048-43-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3048-41-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3048-39-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3048-38-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exe

pid process

3048 fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exe

pid process

3048 fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exe

pid	process
3048	fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exe
3048	fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exe
3048	fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exe

C:\Users\Admin\AppData\Local\Temp\fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exe
"C:\Users\Admin\AppData\Local\Temp\fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3048-1-0x0000000000400000-0x00000000018A7000-memory.dmp

Filesize
20.7MB

Download
memory/3048-0-0x00000000031E0000-0x0000000003387000-memory.dmp

Filesize
1.7MB

Download
memory/3048-2-0x00000000031E0000-0x0000000003387000-memory.dmp

Filesize
1.7MB

Download
memory/3048-3-0x00000000031E0000-0x0000000003387000-memory.dmp

Filesize
1.7MB

Download
memory/3048-4-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/3048-16-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/3048-13-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/3048-23-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/3048-28-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/3048-33-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/3048-36-0x0000000000C30000-0x0000000000EA9000-memory.dmp

Filesize
2.5MB

Download
memory/3048-31-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/3048-26-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/3048-21-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/3048-18-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/3048-11-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/3048-9-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/3048-8-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/3048-6-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/3048-35-0x0000000000400000-0x00000000018A7000-memory.dmp

Filesize
20.7MB

Download
memory/3048-37-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3048-65-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3048-63-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3048-61-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3048-59-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3048-80-0x0000000000400000-0x00000000018A7000-memory.dmp

Filesize
20.7MB

Download
memory/3048-57-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3048-55-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3048-53-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3048-51-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3048-49-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3048-47-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3048-45-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3048-43-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3048-41-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3048-39-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3048-38-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3048-81-0x0000000000400000-0x00000000018A7000-memory.dmp

Filesize
20.7MB

Download
memory/3048-82-0x0000000000400000-0x00000000018A7000-memory.dmp

Filesize
20.7MB

Download
memory/3048-83-0x0000000000C30000-0x0000000000EA9000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads