blackmoon | ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb

General

Target

ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
Size

13.7MB
MD5

dbe4208fb00202aee0a0f2647f9e9e3d
SHA1

fab05eb11f482e1c5e6932795ac54991cdafe6bd
SHA256

ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb
SHA512

f95d4ea97563cd68ddec0640d302d38ef3c24f2d8b59433d40f6c99229d76f931fe9d48d3f26b849ecd34ee77bd69422bb9a50a8788d9836698d647d148a1bf5
SSDEEP

196608:GWb5EYwRqXPpkx+nWih7pPdlBpsMarXLg9wntXBs+7lG9tmZ+ejCKPRJ:vlCokxWFdVlMMar7g9wnTNlgs+HKPr

Score

10^/10

blackmoon banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2028-31-0x0000000000400000-0x000000000121F000-memory.dmp	family_blackmoon
behavioral1/memory/2028-32-0x0000000000400000-0x000000000121F000-memory.dmp	family_blackmoon
behavioral1/memory/2028-41-0x0000000000400000-0x000000000121F000-memory.dmp	family_blackmoon
behavioral1/memory/2028-42-0x0000000000400000-0x000000000121F000-memory.dmp	family_blackmoon
behavioral1/memory/2028-43-0x0000000000400000-0x000000000121F000-memory.dmp	family_blackmoon

Loads dropped DLL 1 IoCs

Processes:

ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe

pid process

2028 ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
Drops file in Windows directory 1 IoCs

Processes:

ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe

description ioc process

File created C:\Windows\Media\xminfo.wav ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Media\xminfo.wav	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe

pid	process
2028	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
2028	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
2028	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
2028	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
2028	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
2028	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
2028	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
2028	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe

description	pid	process
Token: SeDebugPrivilege	2028	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
Token: SeDebugPrivilege	2028	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
Token: SeDebugPrivilege	2028	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe

pid	process
2028	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
2028	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
2028	ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe

C:\Users\Admin\AppData\Local\Temp\ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe
"C:\Users\Admin\AppData\Local\Temp\ae0ceefade37db154191162225153e965b6957e92e025e641d079e2ee7ea06fb.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ÌìÁúÐ¡ÃÛ\ÔËÐÐÎÄ¼þ\QYCJ.dll

Filesize
3.0MB

MD5
54da9cb20347baec926b6678f8efb3ab

SHA1
18ca10861aa561c56666270cca7fd44c73c28d72

SHA256
038675d5ee0b22a17a12646ba9cf3fcffd0a2acfb712c1953102671774a82390

SHA512
e4608ef1875e2dd46c1352d5e750178ce439725a6b190d37a14decb7e960428841ea3ef5e17488226f9bcfc6d58793cb254f142ba4f54cd316c9cbee50cae77b

Download Submit
memory/2028-24-0x00000000012E0000-0x00000000012E1000-memory.dmp

Filesize
4KB

Download
memory/2028-29-0x00000000047D0000-0x0000000004E1C000-memory.dmp

Filesize
6.3MB

Download
memory/2028-28-0x00000000012E0000-0x00000000012E1000-memory.dmp

Filesize
4KB

Download
memory/2028-26-0x00000000012E0000-0x00000000012E1000-memory.dmp

Filesize
4KB

Download
memory/2028-31-0x0000000000400000-0x000000000121F000-memory.dmp

Filesize
14.1MB

Download
memory/2028-32-0x0000000000400000-0x000000000121F000-memory.dmp

Filesize
14.1MB

Download
memory/2028-41-0x0000000000400000-0x000000000121F000-memory.dmp

Filesize
14.1MB

Download
memory/2028-42-0x0000000000400000-0x000000000121F000-memory.dmp

Filesize
14.1MB

Download
memory/2028-43-0x0000000000400000-0x000000000121F000-memory.dmp

Filesize
14.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads