blackmoon | a170681a172ee0fa69742cb3e5e54c1c5cba8c9642ace8d569b9c761e1e548ab

General

Target
07eaca368adc276ced814d80dc0cb540_NeikiAnalytics.exe
Size 332KB
Sample240611-152wwsterb
SHA256 a170681a172ee0fa69742cb3e5e54c1c5cba8c9642ace8d569b9c761e1e548ab
MD5 07eaca368adc276ced814d80dc0cb540
SHA1 658cee63a531b715e5d683b0b3a14fc91e09fdc7
SHA512 063107c5d4a09ff3b17b4bf617fc34cbeeb6ed5c63dccd48d011a57c292b3e9a810d9679d0b85574e7397087c9494f0a7ce5f71f3993cf730b6f4b46df517e15
SSDEEP 6144:Hds8mzWmXZvar2lT+zoJXxEjuIAJZAZiX+ttd6:Hds8XWvag+zuXxEjszmS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackmoon banker trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 6 IoCs

resource	yara_rule
behavioral2/memory/4888-0-0x00000000022D0000-0x00000000022FE000-memory.dmp	family_blackmoon
behavioral2/memory/4112-5-0x0000000002160000-0x000000000218E000-memory.dmp	family_blackmoon
behavioral2/memory/4888-7-0x00000000022D0000-0x00000000022FE000-memory.dmp	family_blackmoon
behavioral2/memory/4112-10-0x0000000002160000-0x000000000218E000-memory.dmp	family_blackmoon
behavioral2/memory/3028-12-0x0000000000730000-0x000000000075E000-memory.dmp	family_blackmoon
behavioral2/memory/3028-15-0x0000000000730000-0x000000000075E000-memory.dmp	family_blackmoon

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	07eaca368adc276ced814d80dc0cb540_NeikiAnalytics.exe

Executes dropped EXE 2 IoCs

pid	Process
4112	LunMarXv.exe
3028	LunMarXv.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3028-13-0x0000000000780000-0x000000000078B000-memory.dmp	upx
behavioral2/memory/3028-14-0x0000000000780000-0x000000000078B000-memory.dmp	upx
behavioral2/memory/3028-16-0x0000000000780000-0x000000000078B000-memory.dmp	upx

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LunMarXv.exe	LunMarXv.exe
File created	C:\Windows\SysWOW64\LunMarXv.exe	07eaca368adc276ced814d80dc0cb540_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\LunMarXv.exe	07eaca368adc276ced814d80dc0cb540_NeikiAnalytics.exe
File created	C:\Windows\system32\LunMarXv.exe	LunMarXv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3272	PING.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4888	07eaca368adc276ced814d80dc0cb540_NeikiAnalytics.exe
4888	07eaca368adc276ced814d80dc0cb540_NeikiAnalytics.exe
4888	07eaca368adc276ced814d80dc0cb540_NeikiAnalytics.exe
4888	07eaca368adc276ced814d80dc0cb540_NeikiAnalytics.exe
4112	LunMarXv.exe
4112	LunMarXv.exe
4112	LunMarXv.exe
4112	LunMarXv.exe
4112	LunMarXv.exe
4112	LunMarXv.exe
4112	LunMarXv.exe
4112	LunMarXv.exe
4112	LunMarXv.exe
4112	LunMarXv.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4888	07eaca368adc276ced814d80dc0cb540_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4888	07eaca368adc276ced814d80dc0cb540_NeikiAnalytics.exe
4112	LunMarXv.exe
3028	LunMarXv.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 4112	4888	07eaca368adc276ced814d80dc0cb540_NeikiAnalytics.exe	85
PID 4888 wrote to memory of 4112	4888	07eaca368adc276ced814d80dc0cb540_NeikiAnalytics.exe	85
PID 4888 wrote to memory of 4112	4888	07eaca368adc276ced814d80dc0cb540_NeikiAnalytics.exe	85
PID 4888 wrote to memory of 4508	4888	07eaca368adc276ced814d80dc0cb540_NeikiAnalytics.exe	86
PID 4888 wrote to memory of 4508	4888	07eaca368adc276ced814d80dc0cb540_NeikiAnalytics.exe	86
PID 4888 wrote to memory of 4508	4888	07eaca368adc276ced814d80dc0cb540_NeikiAnalytics.exe	86
PID 4508 wrote to memory of 3272	4508	cmd.exe	88
PID 4508 wrote to memory of 3272	4508	cmd.exe	88
PID 4508 wrote to memory of 3272	4508	cmd.exe	88
PID 4112 wrote to memory of 3028	4112	LunMarXv.exe	89
PID 4112 wrote to memory of 3028	4112	LunMarXv.exe	89
PID 4112 wrote to memory of 3028	4112	LunMarXv.exe	89

C:\Users\Admin\AppData\Local\Temp\07eaca368adc276ced814d80dc0cb540_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\07eaca368adc276ced814d80dc0cb540_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\SysWOW64\LunMarXv.exe
  -auto C:\Windows\system32\\LunMarXv.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\system32\LunMarXv.exe
    -troj
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3028
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd/c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\[email protected] > nul && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LunMarXv.exe

Path C:\Windows\SysWOW64\LunMarXv.exe
Size 332KB
SHA256 a170681a172ee0fa69742cb3e5e54c1c5cba8c9642ace8d569b9c761e1e548ab
MD5 07eaca368adc276ced814d80dc0cb540
SHA1 658cee63a531b715e5d683b0b3a14fc91e09fdc7
SHA512 063107c5d4a09ff3b17b4bf617fc34cbeeb6ed5c63dccd48d011a57c292b3e9a810d9679d0b85574e7397087c9494f0a7ce5f71f3993cf730b6f4b46df517e15
SSDEEP 6144:Hds8mzWmXZvar2lT+zoJXxEjuIAJZAZiX+ttd6:Hds8XWvag+zuXxEjszmS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3028-12-0x0000000000730000-0x000000000075E000-memory.dmp

Download

memory/3028-13-0x0000000000780000-0x000000000078B000-memory.dmp

Download

memory/3028-14-0x0000000000780000-0x000000000078B000-memory.dmp

Download

memory/3028-15-0x0000000000730000-0x000000000075E000-memory.dmp

Download

memory/3028-16-0x0000000000780000-0x000000000078B000-memory.dmp

Download

memory/4112-5-0x0000000002160000-0x000000000218E000-memory.dmp

Download

memory/4112-10-0x0000000002160000-0x000000000218E000-memory.dmp

Download

memory/4888-0-0x00000000022D0000-0x00000000022FE000-memory.dmp

Download

memory/4888-6-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4888-7-0x00000000022D0000-0x00000000022FE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads