Overview

overview

10

Static

static

3

2a6e8c82e7...b5.exe

windows7-x64

10

2a6e8c82e7...b5.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    26-05-2024 09:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2a6e8c82e7a5129140b7f3b58dfe26e8e6035017397191286a417fdbd1e0aeb5.exe

  • Size

    3.9MB

  • MD5

    05610aaec5183a6b37fb1b0177ef3110

  • SHA1

    42ff8165d48ebd81e449c90bfeaf808366ca9745

  • SHA256

    2a6e8c82e7a5129140b7f3b58dfe26e8e6035017397191286a417fdbd1e0aeb5

  • SHA512

    59269b02ca6eaba7ad9895a94ceb7278f51b7a90f9aba5209b67865a477c4cc09d4724dbb2054209a8078c630de64f79039994011cf6c84009a586af19cff146

  • SSDEEP

    98304:8iJM4l7QGx7D9q6j/IrxIdowPAnY41w/9v65VinbzJNB7I:8x4icCxNY41w/9v6biLd

Score
10/10
blackmoonbankerbootkitevasionpersistencetrojan

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon
  • Detect Blackmoon payload 21 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a6e8c82e7a5129140b7f3b58dfe26e8e6035017397191286a417fdbd1e0aeb5.exe
    "C:\Users\Admin\AppData\Local\Temp\2a6e8c82e7a5129140b7f3b58dfe26e8e6035017397191286a417fdbd1e0aeb5.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2240

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\iext1.fnr.bbs.125.la
    Filesize

    724KB

    MD5

    e60421fdd78fd5c62f7188055202e055

    SHA1

    30874f0a03f409231e8b64be2d76ba9a92c82f31

    SHA256

    aa8bc94c32576e87db8fc327c1103441966380e3e1da30303ce05df40687dd41

    SHA512

    c348fe342c5299b90da1f325a8a3a1defd6bf0da555af0d5bdfd5f1dde7ac871316932fd9fba67feebf2f31ee6978fc63547d3c3317b9c39f9777cf66608460b

    Download Submit
  • memory/2240-0-0x0000000000400000-0x00000000010A6000-memory.dmp
    Filesize

    12.6MB

    Download
  • memory/2240-1-0x0000000077AF0000-0x0000000077AF2000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2240-17-0x0000000004D30000-0x0000000004D31000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2240-18-0x0000000004D40000-0x0000000004D41000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2240-23-0x0000000004D00000-0x0000000004D01000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2240-22-0x0000000004B60000-0x0000000004B61000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2240-21-0x0000000004B50000-0x0000000004B51000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2240-20-0x0000000004DA0000-0x0000000004DA1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2240-19-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2240-16-0x0000000004D50000-0x0000000004D51000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2240-15-0x0000000004B40000-0x0000000004B41000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2240-14-0x0000000004AF0000-0x0000000004AF1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2240-13-0x0000000004D60000-0x0000000004D61000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2240-12-0x0000000004B10000-0x0000000004B11000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2240-11-0x0000000004B20000-0x0000000004B21000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2240-10-0x0000000004B00000-0x0000000004B02000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2240-9-0x0000000004CC0000-0x0000000004CC1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2240-7-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2240-6-0x0000000004AD0000-0x0000000004AD1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2240-5-0x0000000004CF0000-0x0000000004CF1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2240-36-0x0000000000401000-0x0000000000666000-memory.dmp
    Filesize

    2.4MB

    Download
  • memory/2240-4-0x0000000004D20000-0x0000000004D21000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2240-3-0x0000000004B30000-0x0000000004B31000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2240-2-0x0000000004AC0000-0x0000000004AC1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2240-37-0x0000000000400000-0x00000000010A6000-memory.dmp
    Filesize

    12.6MB

    Download
  • memory/2240-40-0x0000000000400000-0x00000000010A6000-memory.dmp
    Filesize

    12.6MB

    Download
  • memory/2240-41-0x0000000000400000-0x00000000010A6000-memory.dmp
    Filesize

    12.6MB

    Download
  • memory/2240-42-0x0000000000400000-0x00000000010A6000-memory.dmp
    Filesize

    12.6MB

    Download
  • memory/2240-43-0x0000000000400000-0x00000000010A6000-memory.dmp
    Filesize

    12.6MB

    Download
  • memory/2240-44-0x0000000000400000-0x00000000010A6000-memory.dmp
    Filesize

    12.6MB

    Download
  • memory/2240-45-0x0000000000400000-0x00000000010A6000-memory.dmp
    Filesize

    12.6MB

    Download
  • memory/2240-46-0x0000000000400000-0x00000000010A6000-memory.dmp
    Filesize

    12.6MB

    Download
  • memory/2240-47-0x0000000005CE0000-0x0000000005EE0000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/2240-49-0x0000000000400000-0x00000000010A6000-memory.dmp
    Filesize

    12.6MB

    Download
  • memory/2240-50-0x0000000000400000-0x00000000010A6000-memory.dmp
    Filesize

    12.6MB

    Download
  • memory/2240-51-0x0000000000400000-0x00000000010A6000-memory.dmp
    Filesize

    12.6MB

    Download
  • memory/2240-54-0x0000000000400000-0x00000000010A6000-memory.dmp
    Filesize

    12.6MB

    Download
  • memory/2240-55-0x0000000000400000-0x00000000010A6000-memory.dmp
    Filesize

    12.6MB

    Download
  • memory/2240-56-0x00000000014F0000-0x00000000015F0000-memory.dmp
    Filesize

    1024KB

    Download
  • memory/2240-58-0x0000000000400000-0x00000000010A6000-memory.dmp
    Filesize

    12.6MB

    Download
  • memory/2240-59-0x0000000000400000-0x00000000010A6000-memory.dmp
    Filesize

    12.6MB

    Download
  • memory/2240-60-0x00000000014F0000-0x00000000015F0000-memory.dmp
    Filesize

    1024KB

    Download
  • memory/2240-62-0x0000000000400000-0x00000000010A6000-memory.dmp
    Filesize

    12.6MB

    Download
  • memory/2240-63-0x0000000000400000-0x00000000010A6000-memory.dmp
    Filesize

    12.6MB

    Download
  • memory/2240-66-0x0000000000400000-0x00000000010A6000-memory.dmp
    Filesize

    12.6MB

    Download
  • memory/2240-67-0x0000000000400000-0x00000000010A6000-memory.dmp
    Filesize

    12.6MB

    Download
  • memory/2240-68-0x00000000014F0000-0x00000000015F0000-memory.dmp
    Filesize

    1024KB

    Download
  • memory/2240-69-0x00000000014F0000-0x00000000015F0000-memory.dmp
    Filesize

    1024KB

    Download
  • memory/2240-70-0x0000000000400000-0x00000000010A6000-memory.dmp
    Filesize

    12.6MB

    Download
  • memory/2240-71-0x0000000000400000-0x00000000010A6000-memory.dmp
    Filesize

    12.6MB

    Download