Analysis
- max time kernel
92s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
08/06/2024, 08:16
General
- Target f6181f9e5f4c319804561999c27f5ab02d1c6820e832823044816f1974ebc7d1.exe
- Size 6.0MB
- Sample240608-j6c6gsbc94
- SHA256 f6181f9e5f4c319804561999c27f5ab02d1c6820e832823044816f1974ebc7d1
Malware Config
Signatures
- Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
- Detect Blackmoon payload 1 IoCs
- Adds policy Run key to start application 2 TTPs 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6181f9e5f4c319804561999c27f5ab02d1c6820e832823044816f1974ebc7d1.exe"C:\Users\Admin\AppData\Local\Temp\f6181f9e5f4c319804561999c27f5ab02d1c6820e832823044816f1974ebc7d1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f6181f9e5f4c319804561999c27f5ab02d1c6820e832823044816f1974ebc7d1.exeC:\Users\Admin\AppData\Local\Temp\f6181f9e5f4c319804561999c27f5ab02d1c6820e832823044816f1974ebc7d1.exe 45063C065A065606740669066106740667066B0642066706720667065A0647066F0665066F06650667065A067D067606340634066A063506350675067C06300653066F06330671067E0636063F067B065A0677064A066506310669067506320631066A06--3652⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Aicica\{p22l33sz6Ui5wx09}\qLc7os47l.exe"C:\ProgramData\Aicica\{p22l33sz6Ui5wx09}\qLc7os47l.exe"3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
qLc7os47l.exe
qLc7os47l.txt
winfsp-x86.dll
memory/1840-36-0x0000000004A30000-0x0000000004A82000-memory.dmp
memory/1840-42-0x0000000002D40000-0x0000000002E27000-memory.dmp
memory/1840-20-0x0000000002D40000-0x0000000002E27000-memory.dmp
memory/1840-21-0x0000000002D40000-0x0000000002E27000-memory.dmp
memory/1840-19-0x0000000002940000-0x0000000002941000-memory.dmp
memory/1840-23-0x0000000002D40000-0x0000000002E27000-memory.dmp
memory/1840-24-0x0000000003ED0000-0x00000000040E1000-memory.dmp
memory/1840-29-0x00000000041A0000-0x00000000041F6000-memory.dmp
memory/1840-28-0x0000000004550000-0x000000000463B000-memory.dmp
memory/1840-33-0x0000000004640000-0x00000000046D9000-memory.dmp
memory/1840-34-0x0000000004BF0000-0x0000000004D65000-memory.dmp
memory/1840-32-0x0000000004BF0000-0x0000000004D65000-memory.dmp
memory/1840-31-0x0000000004550000-0x000000000463B000-memory.dmp
memory/1840-17-0x0000000002930000-0x0000000002931000-memory.dmp
memory/1840-18-0x0000000002920000-0x0000000002921000-memory.dmp
memory/1840-39-0x0000000004A30000-0x0000000004A82000-memory.dmp
memory/1840-37-0x0000000004120000-0x0000000004121000-memory.dmp
memory/1840-40-0x0000000004BB0000-0x0000000004BB1000-memory.dmp
memory/1840-41-0x00000000028F0000-0x0000000002910000-memory.dmp
memory/1840-38-0x0000000003ED0000-0x00000000040E1000-memory.dmp
memory/1840-46-0x0000000004550000-0x000000000463B000-memory.dmp
memory/1840-45-0x0000000003ED0000-0x00000000040E1000-memory.dmp
memory/1840-44-0x0000000004E80000-0x0000000004E81000-memory.dmp
memory/1840-43-0x0000000005950000-0x0000000005A4C000-memory.dmp
memory/1840-47-0x0000000004BF0000-0x0000000004D65000-memory.dmp
memory/1840-48-0x0000000005C30000-0x0000000005C50000-memory.dmp
memory/1840-49-0x0000000004640000-0x00000000046D9000-memory.dmp
memory/1840-50-0x0000000004A30000-0x0000000004A82000-memory.dmp
memory/1840-51-0x0000000005950000-0x0000000005A4C000-memory.dmp