blackmoon | 6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73

General

Target

6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
Size

15.9MB
MD5

d6c0680a365900389cf6dfbe1c6b335f
SHA1

55abd050b6ca4302353935e4353279a2e6c24be2
SHA256

6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73
SHA512

671a5b4c7badfd3e9dd24c10e69f252fddfc63cff570372cf5b3392ba8f4208b04e857195b49b608d887dda5b2d16037766d5ad341e2e29b553d74ff55ae8744
SSDEEP

393216:iOVkpwpGNvDasmODLxhLelF3LhAvxF3zTgiV64ag:1VkpwpGZvPxhLelF3Laf3H6A

Score

10^/10

blackmoon banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 10 IoCs

resource	yara_rule
behavioral1/memory/2848-6-0x0000000000400000-0x00000000009FA000-memory.dmp	family_blackmoon
behavioral1/memory/2848-7-0x0000000000400000-0x00000000009FA000-memory.dmp	family_blackmoon
behavioral1/memory/2848-8-0x0000000000400000-0x00000000009FA000-memory.dmp	family_blackmoon
behavioral1/memory/2848-10-0x0000000000400000-0x00000000009FA000-memory.dmp	family_blackmoon
behavioral1/memory/2848-9-0x0000000000400000-0x00000000009FA000-memory.dmp	family_blackmoon
behavioral1/memory/2848-21-0x0000000000400000-0x00000000009FA000-memory.dmp	family_blackmoon
behavioral1/memory/2108-26-0x0000000000400000-0x00000000009FA000-memory.dmp	family_blackmoon
behavioral1/memory/2108-27-0x0000000000400000-0x00000000009FA000-memory.dmp	family_blackmoon
behavioral1/memory/2108-49-0x0000000000400000-0x00000000009FA000-memory.dmp	family_blackmoon
behavioral1/memory/2108-51-0x0000000000400000-0x00000000009FA000-memory.dmp	family_blackmoon

Executes dropped EXE 1 IoCs

pid	Process
2108	133996a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe

Loads dropped DLL 1 IoCs

pid	Process
2848	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
File opened (read-only)	\??\S:	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
File opened (read-only)	\??\A:	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
File opened (read-only)	\??\E:	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
File opened (read-only)	\??\J:	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
File opened (read-only)	\??\K:	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
File opened (read-only)	\??\N:	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
File opened (read-only)	\??\Q:	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
File opened (read-only)	\??\T:	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
File opened (read-only)	\??\U:	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
File opened (read-only)	\??\O:	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
File opened (read-only)	\??\Y:	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
File opened (read-only)	\??\Z:	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
File opened (read-only)	\??\B:	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
File opened (read-only)	\??\G:	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
File opened (read-only)	\??\I:	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
File opened (read-only)	\??\L:	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
File opened (read-only)	\??\M:	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
File opened (read-only)	\??\P:	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
File opened (read-only)	\??\R:	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
File opened (read-only)	\??\V:	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
File opened (read-only)	\??\W:	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
File opened (read-only)	\??\X:	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	133996a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2848	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
2848	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
2848	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
2108	133996a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
2108	133996a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
2108	133996a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2108	2848	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe	28
PID 2848 wrote to memory of 2108	2848	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe	28
PID 2848 wrote to memory of 2108	2848	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe	28
PID 2848 wrote to memory of 2108	2848	6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe	28

C:\Users\Admin\AppData\Local\Temp\6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
"C:\Users\Admin\AppData\Local\Temp\6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848
- C:\·ãµ¶ÃÔÊ§Î¢¶Ë\133996a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
  C:\·ãµ¶ÃÔÊ§Î¢¶Ë\133996a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\534b78c41edc0fabcae69bce52725649.txt

Filesize
16B

MD5
a5b4bad223cdce450a03a66e8ddc7fb3

SHA1
93d33e0a3e243575f85857c9cad55b358b3eac40

SHA256
cae78e4f08f9f536c08e7c6ad49a45f593010401a66d8230cf9e7bcd6f11a493

SHA512
f61d8fa092feaa1646ba96240455053470598d4c71d59bfd8a5db22b344eadfba773d0558cbbf2672b65b2d89e8c6487a00dd3dbdc3d6241e0d473f682def8a9

Download Submit
\·ãµ¶ÃÔÊ§Î¢¶Ë\133996a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73.exe

Filesize
15.9MB

MD5
d6c0680a365900389cf6dfbe1c6b335f

SHA1
55abd050b6ca4302353935e4353279a2e6c24be2

SHA256
6a38e6b0ae91729e77a5ae4959e0fcc678575ba76984548ab632d24380090f73

SHA512
671a5b4c7badfd3e9dd24c10e69f252fddfc63cff570372cf5b3392ba8f4208b04e857195b49b608d887dda5b2d16037766d5ad341e2e29b553d74ff55ae8744

Download Submit
memory/2108-51-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/2108-49-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/2108-27-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/2108-26-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/2108-22-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/2848-7-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/2848-9-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/2848-19-0x00000000074D0000-0x0000000007ACA000-memory.dmp

Filesize
6.0MB

Download
memory/2848-10-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/2848-21-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/2848-18-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2848-8-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/2848-0-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/2848-6-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/2848-5-0x00000000004FF000-0x0000000000500000-memory.dmp

Filesize
4KB

Download
memory/2848-1-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing