blackmoon | 90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123

General

Target

90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
Size

15.2MB
MD5

a258eb79d3c79663b17daa4e272e6e46
SHA1

8f3630580583bd6b6da62de90b16f9abc74622cd
SHA256

90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123
SHA512

2f4d7fdee5d620bbb34604625114b2081f8c54304f4ad1a7d275e39d5cd2cdefaff61afa2d517f8cff3a960e5e5acd6e71ca04146a7e01225849c06451853eb1
SSDEEP

196608:PYPDPy737nKKWUGNEoiN/A4s33/hhUdCAW1MslNY3LhAvx3fg5fADU0+sJm0+nzn:gPDPsLpGNvnodC543LhAvx4fADyL2yOo

Score

10^/10

blackmoon aspackv2 banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 8 IoCs

resource	yara_rule
behavioral2/memory/1716-1-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/1716-2-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/1716-3-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/5064-17-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/5064-20-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/5064-21-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/1716-19-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/5064-50-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000400000001db63-14.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5064	2404290a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
File opened (read-only)	\??\N:	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
File opened (read-only)	\??\P:	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
File opened (read-only)	\??\Q:	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
File opened (read-only)	\??\S:	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
File opened (read-only)	\??\U:	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
File opened (read-only)	\??\B:	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
File opened (read-only)	\??\J:	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
File opened (read-only)	\??\K:	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
File opened (read-only)	\??\R:	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
File opened (read-only)	\??\G:	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
File opened (read-only)	\??\L:	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
File opened (read-only)	\??\V:	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
File opened (read-only)	\??\W:	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
File opened (read-only)	\??\Z:	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
File opened (read-only)	\??\X:	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
File opened (read-only)	\??\Y:	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
File opened (read-only)	\??\A:	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
File opened (read-only)	\??\H:	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
File opened (read-only)	\??\I:	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
File opened (read-only)	\??\M:	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
File opened (read-only)	\??\O:	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
File opened (read-only)	\??\T:	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1716	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
1716	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
1716	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
5064	2404290a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
5064	2404290a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
5064	2404290a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 5064	1716	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe	84
PID 1716 wrote to memory of 5064	1716	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe	84
PID 1716 wrote to memory of 5064	1716	90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe	84

C:\Users\Admin\AppData\Local\Temp\90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
"C:\Users\Admin\AppData\Local\Temp\90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716
- C:\9SFèóÌì»ðÁú\2404290a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
  C:\9SFèóÌì»ðÁú\2404290a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\9SFèóÌì»ðÁú\2404290a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123.exe

Filesize
15.2MB

MD5
a258eb79d3c79663b17daa4e272e6e46

SHA1
8f3630580583bd6b6da62de90b16f9abc74622cd

SHA256
90a797019be27d3010108d63633b02fefc6b37e7af6f6aecdece633353edf123

SHA512
2f4d7fdee5d620bbb34604625114b2081f8c54304f4ad1a7d275e39d5cd2cdefaff61afa2d517f8cff3a960e5e5acd6e71ca04146a7e01225849c06451853eb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\3aadc5b5135080c3bca0676274585abd.txt

Filesize
15B

MD5
6556c44b3892622859850a8f8a3fff76

SHA1
f297fd82e59f562cc9d2fd8f5e626d8707bb5372

SHA256
a3dab5278055926ff314bfcc454998b3ee258982cd025d9f0d3d6a671b610073

SHA512
76da8be1ff41c69aceea4ea7e18aad6af9e055c4e3e306473bf7e24393cd738d6b13038372ce08f23333f1b48c246c3c64270b95ac3fe43a07daa52a17c31bcc

Download Submit
memory/1716-7-0x0000000003C70000-0x0000000003C71000-memory.dmp

Filesize
4KB

Download
memory/1716-3-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/1716-9-0x0000000003DD0000-0x0000000003DD1000-memory.dmp

Filesize
4KB

Download
memory/1716-8-0x0000000003C50000-0x0000000003C51000-memory.dmp

Filesize
4KB

Download
memory/1716-0-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/1716-2-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/1716-19-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/1716-1-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/5064-17-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/5064-20-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/5064-21-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/5064-50-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download

Analysis

Sharing