blackmoon | 812241ef6c9649f97b0635692a1844ddb9be6fa2e16dde57888c40bb5ca8e501

Analysis

max time kernel
142s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 03:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dnf千珏辅助v5.12/千珏5.12破解版.exe
Size 1.4MB
Sample240606-dv8v5afe3t
SHA256 17a507ceffc7000806a8dd2e636e74f1864c830e2c6e39646d2cd6be125f3604
MD5 ef9f66ff2fcea551cfc5f29169bfb30d
SHA1 34a40e865239648e3f58dee8d88c4726ca9c152b
SHA512 74204f819ccdeebaa0653311accf1a4881213dda736c54078c11a83774bf14ffcf1a965757da8669a692c854f3b30521db9f2f648e0158a6614399f03f5de3dc
SSDEEP 24576:9ZPpclG45Vocf/7mjYY1G4uv/iorfWtRGR06qZ0V3gQznmPrSd+nKbtk+64WV:elG4jocHkMCorfgkR06qZc3gQzmPrS4d
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackmoon banker trojan vmprotect

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000b000000023214-4.dat	family_blackmoon

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	千珏5.12破解版.exe

Executes dropped EXE 2 IoCs

pid	Process
4816	千珏05-10A破解版.exe
3580	001.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/4816-18-0x00000000025C0000-0x000000000278D000-memory.dmp	vmprotect
behavioral2/memory/4816-20-0x00000000025C0000-0x000000000278D000-memory.dmp	vmprotect
behavioral2/memory/4816-21-0x00000000025C0000-0x000000000278D000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4816	千珏05-10A破解版.exe
4816	千珏05-10A破解版.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4816	千珏05-10A破解版.exe
4816	千珏05-10A破解版.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 4816	1800	千珏5.12破解版.exe	90
PID 1800 wrote to memory of 4816	1800	千珏5.12破解版.exe	90
PID 1800 wrote to memory of 4816	1800	千珏5.12破解版.exe	90
PID 1800 wrote to memory of 3580	1800	千珏5.12破解版.exe	91
PID 1800 wrote to memory of 3580	1800	千珏5.12破解版.exe	91
PID 1800 wrote to memory of 3580	1800	千珏5.12破解版.exe	91

C:\Users\Admin\AppData\Local\Temp\dnf千珏辅助v5.12\千珏5.12破解版.exe
"C:\Users\Admin\AppData\Local\Temp\dnf千珏辅助v5.12\千珏5.12破解版.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Users\Admin\AppData\Local\Temp\千珏05-10A破解版.exe
  "C:\Users\Admin\AppData\Local\Temp\千珏05-10A破解版.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4816
- C:\Users\Admin\AppData\Local\Temp\001.exe
  "C:\Users\Admin\AppData\Local\Temp\001.exe"
  2⤵
  - Executes dropped EXE
  PID:3580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4484 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

001.exe

Path C:\Users\Admin\AppData\Local\Temp\001.exe
Size 42KB
SHA256 32e46989c60e4aace09e6031dfdbe273fa7a7e9c875022a290461c3ef153dcba
MD5 bb79ebf3e0fd5981bb68b15886e09233
SHA1 ec9923e51740ae1196efacf592379e56d6e16820
SHA512 632cd1d2c90e5eff666bc3cf19a0fa0cf7ef559b6121814af983dfddb3f0d4812f6d5ee6b2de7cac58d72a50f4fbc66c47f1c813ccd72d3ce9b79e202d16a979
SSDEEP 768:yh/J3nk3b0S1hodxgKh9Zmwn1fRzn/USlhWcTAMx/uNAXKoXR3DuDuo5tyaI2AcC:K/JXk3QUhegk9ZRpbn1AMxmNKKIKNaoC
MD5 SHA1 SHA512 SSDEEP

Submit Download

千珏05-10A破解版.exe

Path C:\Users\Admin\AppData\Local\Temp\千珏05-10A破解版.exe
Size 2.0MB
SHA256 004d894cb015bdb0560b1c77b985e7a072f84f7e0f3c68564ebd24b1cde1ed46
MD5 b43ed4e982d8c47fa31dbc66488806f3
SHA1 982d56cf97ab2348c3b6118ba618ad5000c1a361
SHA512 b4b2c6a1a2af2f195494a9248ec13b5ce30941bc51f965ee9d88150c4289acfdc9683503c8b2d26502efe07ccd4bc7c16a0e6dc6ae3899d93c10b9fb870b9ff8
SSDEEP 24576:Wq6P6G1ZsoMQGPfu9TatVOxKlL011uHg24YGe8MBp6ayqo1RYxKGkj4pkIO7hE9n:WPP6mMQ+GNcxeyp6ano1RYsj4Eh5SLiU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4816-18-0x00000000025C0000-0x000000000278D000-memory.dmp

Download

memory/4816-20-0x00000000025C0000-0x000000000278D000-memory.dmp

Download

memory/4816-21-0x00000000025C0000-0x000000000278D000-memory.dmp

Download

memory/4816-25-0x00000000025C0000-0x000000000278D000-memory.dmp

Download