blackmoon | 32b7d268fa796119a3caf7bc23b47f993589f0c319ff4e3fc4802e4f5fba24d5

Analysis

max time kernel
149s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32b7d268fa796119a3caf7bc23b47f993589f0c319ff4e3fc4802e4f5fba24d5.exe
Size

87KB
MD5

6ed318b9920a467cb2314144661fe0ca
SHA1

f0355c8cb8d49be5802b04a48296c8360ae0ed60
SHA256

32b7d268fa796119a3caf7bc23b47f993589f0c319ff4e3fc4802e4f5fba24d5
SHA512

80a6a702cdeb0df87ad267864438990f6b963f7b22931c744d65313c8b729d1688b5fc18edae1865ae3660b2a272f4bd14714d2897bf0a468e6a526f44d6eabf
SSDEEP

1536:D3ScSeuCQ5CvP3ErbK0GsA1Irn6ykkXERklFceLnFaswUemjmh5WGiirTb9Qyz+:DSleucPUXKhsmIGZkXYUJFg5fRiaTRO

Score

10^/10

blackmoon banker trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 4 IoCs

resource	yara_rule
behavioral2/memory/1516-2-0x0000000000400000-0x000000000047E000-memory.dmp	family_blackmoon
behavioral2/memory/1516-4-0x0000000000400000-0x000000000047E000-memory.dmp	family_blackmoon
behavioral2/memory/1516-17-0x0000000000400000-0x000000000047E000-memory.dmp	family_blackmoon
behavioral2/memory/1764-19-0x0000000000400000-0x000000000047E000-memory.dmp	family_blackmoon

UPX dump on OEP (original entry point) 7 IoCs

resource	yara_rule
behavioral2/memory/1516-0-0x0000000000400000-0x000000000047E000-memory.dmp	UPX
behavioral2/memory/1516-2-0x0000000000400000-0x000000000047E000-memory.dmp	UPX
behavioral2/memory/1516-4-0x0000000000400000-0x000000000047E000-memory.dmp	UPX
behavioral2/files/0x00070000000233ed-11.dat	UPX
behavioral2/memory/1764-16-0x0000000000400000-0x000000000047E000-memory.dmp	UPX
behavioral2/memory/1516-17-0x0000000000400000-0x000000000047E000-memory.dmp	UPX
behavioral2/memory/1764-19-0x0000000000400000-0x000000000047E000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	32b7d268fa796119a3caf7bc23b47f993589f0c319ff4e3fc4802e4f5fba24d5.exe

Deletes itself 1 IoCs

pid	Process
1764	Systemnbvwx.exe

Executes dropped EXE 1 IoCs

pid	Process
1764	Systemnbvwx.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1516-0-0x0000000000400000-0x000000000047E000-memory.dmp	upx
behavioral2/memory/1516-2-0x0000000000400000-0x000000000047E000-memory.dmp	upx
behavioral2/memory/1516-4-0x0000000000400000-0x000000000047E000-memory.dmp	upx
behavioral2/files/0x00070000000233ed-11.dat	upx
behavioral2/memory/1764-16-0x0000000000400000-0x000000000047E000-memory.dmp	upx
behavioral2/memory/1516-17-0x0000000000400000-0x000000000047E000-memory.dmp	upx
behavioral2/memory/1764-19-0x0000000000400000-0x000000000047E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1516	32b7d268fa796119a3caf7bc23b47f993589f0c319ff4e3fc4802e4f5fba24d5.exe
1516	32b7d268fa796119a3caf7bc23b47f993589f0c319ff4e3fc4802e4f5fba24d5.exe
1516	32b7d268fa796119a3caf7bc23b47f993589f0c319ff4e3fc4802e4f5fba24d5.exe
1516	32b7d268fa796119a3caf7bc23b47f993589f0c319ff4e3fc4802e4f5fba24d5.exe
1516	32b7d268fa796119a3caf7bc23b47f993589f0c319ff4e3fc4802e4f5fba24d5.exe
1516	32b7d268fa796119a3caf7bc23b47f993589f0c319ff4e3fc4802e4f5fba24d5.exe
1516	32b7d268fa796119a3caf7bc23b47f993589f0c319ff4e3fc4802e4f5fba24d5.exe
1516	32b7d268fa796119a3caf7bc23b47f993589f0c319ff4e3fc4802e4f5fba24d5.exe
1516	32b7d268fa796119a3caf7bc23b47f993589f0c319ff4e3fc4802e4f5fba24d5.exe
1516	32b7d268fa796119a3caf7bc23b47f993589f0c319ff4e3fc4802e4f5fba24d5.exe
1516	32b7d268fa796119a3caf7bc23b47f993589f0c319ff4e3fc4802e4f5fba24d5.exe
1516	32b7d268fa796119a3caf7bc23b47f993589f0c319ff4e3fc4802e4f5fba24d5.exe
1516	32b7d268fa796119a3caf7bc23b47f993589f0c319ff4e3fc4802e4f5fba24d5.exe
1516	32b7d268fa796119a3caf7bc23b47f993589f0c319ff4e3fc4802e4f5fba24d5.exe
1516	32b7d268fa796119a3caf7bc23b47f993589f0c319ff4e3fc4802e4f5fba24d5.exe
1516	32b7d268fa796119a3caf7bc23b47f993589f0c319ff4e3fc4802e4f5fba24d5.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe
1764	Systemnbvwx.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 1764	1516	32b7d268fa796119a3caf7bc23b47f993589f0c319ff4e3fc4802e4f5fba24d5.exe	86
PID 1516 wrote to memory of 1764	1516	32b7d268fa796119a3caf7bc23b47f993589f0c319ff4e3fc4802e4f5fba24d5.exe	86
PID 1516 wrote to memory of 1764	1516	32b7d268fa796119a3caf7bc23b47f993589f0c319ff4e3fc4802e4f5fba24d5.exe	86

C:\Users\Admin\AppData\Local\Temp\32b7d268fa796119a3caf7bc23b47f993589f0c319ff4e3fc4802e4f5fba24d5.exe
"C:\Users\Admin\AppData\Local\Temp\32b7d268fa796119a3caf7bc23b47f993589f0c319ff4e3fc4802e4f5fba24d5.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Users\Admin\AppData\Local\Temp\Systemnbvwx.exe
  "C:\Users\Admin\AppData\Local\Temp\Systemnbvwx.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Systemnbvwx.exe

Filesize
87KB

MD5
79fdbe8dac6604aee62603e3ec4bbc1d

SHA1
0b56504a98970e9679f7147fecd4fd19e3c60b38

SHA256
dda01a181e7ab3873b8899342c2caf40038c7477fa056494c94aea9e3f3b641a

SHA512
df7154c990d99f4b4513b8eff6deaa20319ba7149aad07137a9ac17cb9e9d33ddbbf48f2a31cc2bcf9d08c49d870f911a0febb6c3cc46cbe7c2a3d40ff200976

Download Submit
C:\Users\Admin\AppData\Local\Temp\path.ini

Filesize
102B

MD5
1672e85262304a8ab02faab3965c5dd3

SHA1
3dded55988fb705d345da4e543c1f4e4e1d904d9

SHA256
d81130049b32608adb8db21e26c4497c0f26a7643c02dfb2143da8b4112f308d

SHA512
0e069a912bd6cbdbcd4422090b9eb7d04166959ea398683be84c4e0cdfd30507305110bc1a3db5bb22f7333e905b7fb1ea48278e9f8dee3a0a4c6a48e69cf805

Download Submit
memory/1516-0-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1516-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1516-4-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1516-17-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1764-16-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1764-19-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download