blackmoon | 6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d

General

Target

6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
Size

7.2MB
MD5

55e9336ab88a1d3c154cde734fb4c5eb
SHA1

a78dbb7f1d64669211f4cc9cf1ea2ac43e900475
SHA256

6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d
SHA512

6e8f2d1e393808b02d52631d264632e8cac98c58d9cec5e975774208b16d6730862ffc923c9593d73d0156c947c48969c161264518530b8a838821eb32de26b5
SSDEEP

196608:PYPDPyGflrNDbtXRd6SdJNU6mUqnJMELuvloEyt4kaaZPuLm:gPDPbflFbN6yy6rEEqEywZC

Score

10^/10

blackmoon aspackv2 banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 8 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3024-2-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/3024-1-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/3024-3-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/3060-19-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/3060-21-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/3024-20-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/3060-18-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/3060-50-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\ÌìÑÄÎäÒ×\421646565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

421646565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe

pid process

3060 421646565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe

pid	process
3060	421646565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe

description	ioc	process
File opened (read-only)	\??\P:	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
File opened (read-only)	\??\Q:	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
File opened (read-only)	\??\R:	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
File opened (read-only)	\??\S:	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
File opened (read-only)	\??\U:	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
File opened (read-only)	\??\V:	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
File opened (read-only)	\??\W:	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
File opened (read-only)	\??\G:	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
File opened (read-only)	\??\Y:	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
File opened (read-only)	\??\X:	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
File opened (read-only)	\??\J:	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
File opened (read-only)	\??\K:	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
File opened (read-only)	\??\B:	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
File opened (read-only)	\??\L:	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
File opened (read-only)	\??\O:	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
File opened (read-only)	\??\A:	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
File opened (read-only)	\??\H:	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
File opened (read-only)	\??\I:	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
File opened (read-only)	\??\M:	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
File opened (read-only)	\??\N:	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
File opened (read-only)	\??\T:	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
File opened (read-only)	\??\Z:	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
File opened (read-only)	\??\E:	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe421646565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe

pid	process
3024	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
3024	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
3024	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
3060	421646565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
3060	421646565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
3060	421646565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe

description	pid	process	target process
PID 3024 wrote to memory of 3060	3024	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe	421646565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
PID 3024 wrote to memory of 3060	3024	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe	421646565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
PID 3024 wrote to memory of 3060	3024	6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe	421646565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe

C:\Users\Admin\AppData\Local\Temp\6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
"C:\Users\Admin\AppData\Local\Temp\6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024

C:\ÌìÑÄÎäÒ×\421646565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
C:\ÌìÑÄÎäÒ×\421646565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4380,i,15142778360084620907,1763097090506261076,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
1⤵
PID:4516

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\18bd283a693626aec9d1ca9f574bd170.txt
Filesize
12B

MD5
333de08caba6e5cf6852dc86261a0371

SHA1
65f3cff93d871d9c415f1d32f2a52f539986c6f9

SHA256
9247dcc319be2de3edb573511ab88c9049904f2264c7f9b158aafba4a7b84efc

SHA512
cbf9af4c11030715a2fc312c1f08496d38beacc346a9470db7794e162f3858c94def296dfbe54a3042d40926d80c7537e543ef53409e5d49cd61131c983cf6ca

Download Submit
C:\ÌìÑÄÎäÒ×\421646565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d.exe
Filesize
7.2MB

MD5
55e9336ab88a1d3c154cde734fb4c5eb

SHA1
a78dbb7f1d64669211f4cc9cf1ea2ac43e900475

SHA256
6565fc2fc8663cf46f2496dac6f3fc554373c1bacf2497efdc8cc6993897ba8d

SHA512
6e8f2d1e393808b02d52631d264632e8cac98c58d9cec5e975774208b16d6730862ffc923c9593d73d0156c947c48969c161264518530b8a838821eb32de26b5

Download Submit
memory/3024-7-0x0000000003CD0000-0x0000000003CD1000-memory.dmp

Filesize
4KB

Download
memory/3024-3-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/3024-9-0x00000000040F0000-0x00000000040F1000-memory.dmp

Filesize
4KB

Download
memory/3024-8-0x0000000003C70000-0x0000000003C71000-memory.dmp

Filesize
4KB

Download
memory/3024-0-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/3024-1-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/3024-20-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/3024-2-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/3060-16-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/3060-19-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/3060-21-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/3060-18-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/3060-50-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads