Analysis
- max time kernel
143s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
08/06/2024, 01:39
General
- Target f6181f9e5f4c319804561999c27f5ab02d1c6820e832823044816f1974ebc7d1.exe
- Size 6.0MB
- Sample240608-b3fs7sfc6w
- SHA256 f6181f9e5f4c319804561999c27f5ab02d1c6820e832823044816f1974ebc7d1
Malware Config
Signatures
- Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
- Detect Blackmoon payload 1 IoCs
- UPX dump on OEP (original entry point) 17 IoCs
- Adds policy Run key to start application 2 TTPs 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6181f9e5f4c319804561999c27f5ab02d1c6820e832823044816f1974ebc7d1.exe"C:\Users\Admin\AppData\Local\Temp\f6181f9e5f4c319804561999c27f5ab02d1c6820e832823044816f1974ebc7d1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f6181f9e5f4c319804561999c27f5ab02d1c6820e832823044816f1974ebc7d1.exeC:\Users\Admin\AppData\Local\Temp\f6181f9e5f4c319804561999c27f5ab02d1c6820e832823044816f1974ebc7d1.exe 45063C065A065606740669066106740667066B0642066706720667065A0647066F0665066F06650667065A067D06330630065306400644064D06370636063F06370633065E0634064F067B065A06320674063F064A06350652066706--3652⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Aicica\{56UFBK10915X2I}\4r9L3Ta.exe"C:\ProgramData\Aicica\{56UFBK10915X2I}\4r9L3Ta.exe"3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3020 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
4r9L3Ta.exe
4r9L3Ta.txt
winfsp-x86.dll
memory/1172-30-0x0000000004910000-0x00000000049FB000-memory.dmp
memory/1172-33-0x0000000004F40000-0x00000000050B5000-memory.dmp
memory/1172-20-0x0000000002F90000-0x0000000003077000-memory.dmp
memory/1172-21-0x0000000002F90000-0x0000000003077000-memory.dmp
memory/1172-23-0x0000000002F90000-0x0000000003077000-memory.dmp
memory/1172-18-0x0000000002B30000-0x0000000002B31000-memory.dmp
memory/1172-24-0x00000000042C0000-0x00000000044D1000-memory.dmp
memory/1172-29-0x0000000004910000-0x00000000049FB000-memory.dmp
memory/1172-28-0x00000000048A0000-0x00000000048F6000-memory.dmp
memory/1172-17-0x0000000002B40000-0x0000000002B41000-memory.dmp
memory/1172-32-0x0000000004A40000-0x0000000004AD9000-memory.dmp
memory/1172-19-0x0000000002C20000-0x0000000002C21000-memory.dmp
memory/1172-34-0x0000000004F40000-0x00000000050B5000-memory.dmp
memory/1172-36-0x00000000050C0000-0x0000000005112000-memory.dmp
memory/1172-37-0x0000000004520000-0x0000000004521000-memory.dmp
memory/1172-38-0x00000000042C0000-0x00000000044D1000-memory.dmp
memory/1172-39-0x00000000050C0000-0x0000000005112000-memory.dmp
memory/1172-40-0x0000000002F90000-0x0000000003077000-memory.dmp
memory/1172-41-0x00000000042C0000-0x00000000044D1000-memory.dmp
memory/1172-42-0x00000000048A0000-0x00000000048F6000-memory.dmp
memory/1172-43-0x0000000004910000-0x00000000049FB000-memory.dmp
memory/1172-44-0x0000000004A40000-0x0000000004AD9000-memory.dmp
memory/1172-45-0x0000000004F40000-0x00000000050B5000-memory.dmp
memory/1172-46-0x00000000050C0000-0x0000000005112000-memory.dmp