blackmoon | 3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145

General

Target

3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
Size

13.8MB
MD5

1d9cea8e9d6c540927031efa5eb68b1b
SHA1

d01258fa92d1243df15d1d136ed025dae446a283
SHA256

3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145
SHA512

5a250900732415b3776490304136b951b3e1fecfce87cfe531e26e75637bef31d2884fd754dee144c562bc0cc8da23771c34e574b5f2969b4974df1461a40868
SSDEEP

393216:gPDPOTleBcdgmmJdSaLdc91I44291UbffF:YGVdg5JdSOdch429qx

Score

10^/10

blackmoon aspackv2 banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 9 IoCs

resource	yara_rule
behavioral2/memory/968-2-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/968-0-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/968-3-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/968-20-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/4976-21-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/4976-18-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/4976-17-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/4976-19-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon
behavioral2/memory/4976-50-0x0000000000400000-0x0000000000926000-memory.dmp	family_blackmoon

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x00030000000006df-14.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4976	115193a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
File opened (read-only)	\??\S:	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
File opened (read-only)	\??\T:	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
File opened (read-only)	\??\A:	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
File opened (read-only)	\??\H:	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
File opened (read-only)	\??\L:	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
File opened (read-only)	\??\O:	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
File opened (read-only)	\??\X:	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
File opened (read-only)	\??\I:	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
File opened (read-only)	\??\J:	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
File opened (read-only)	\??\K:	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
File opened (read-only)	\??\Y:	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
File opened (read-only)	\??\Z:	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
File opened (read-only)	\??\E:	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
File opened (read-only)	\??\Q:	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
File opened (read-only)	\??\V:	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
File opened (read-only)	\??\P:	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
File opened (read-only)	\??\R:	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
File opened (read-only)	\??\U:	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
File opened (read-only)	\??\W:	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
File opened (read-only)	\??\B:	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
File opened (read-only)	\??\G:	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
File opened (read-only)	\??\N:	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
968	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
968	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
968	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
4976	115193a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
4976	115193a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
4976	115193a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 4976	968	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe	81
PID 968 wrote to memory of 4976	968	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe	81
PID 968 wrote to memory of 4976	968	3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe	81

C:\Users\Admin\AppData\Local\Temp\3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
"C:\Users\Admin\AppData\Local\Temp\3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:968
- C:\ÐÒ¸£¾Æ¹í\115193a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
  C:\ÐÒ¸£¾Æ¹í\115193a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c6ba0a69943ff6a4446e32b279aeeb89.txt

Filesize
12B

MD5
0bc96d94406f28b439b69720f340ca07

SHA1
b44f175f97d3db6e96b202225b585837417c79d1

SHA256
1d72086f56f6ec79439c60c82577fbd181eef1f4f734ab4f51875a3e0a3afc6b

SHA512
ef9c849d77a27d5371571cf8b9d73c2d2c85e6d172f6565e9426ece773234223aa78ae4a26280f6f2f91cfa109182ed9faa0428a2e3c10dde0ff2f1efd0e6409

Download Submit
C:\ÐÒ¸£¾Æ¹í\115193a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145.exe

Filesize
13.8MB

MD5
1d9cea8e9d6c540927031efa5eb68b1b

SHA1
d01258fa92d1243df15d1d136ed025dae446a283

SHA256
3a0dfcad73d46e987045ef02f2a0b811c66b6f9ae223c6d78ea5d3442fcca145

SHA512
5a250900732415b3776490304136b951b3e1fecfce87cfe531e26e75637bef31d2884fd754dee144c562bc0cc8da23771c34e574b5f2969b4974df1461a40868

Download Submit
memory/968-7-0x00000000040D0000-0x00000000040D1000-memory.dmp

Filesize
4KB

Download
memory/968-3-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/968-9-0x00000000040E0000-0x00000000040E1000-memory.dmp

Filesize
4KB

Download
memory/968-8-0x0000000003B20000-0x0000000003B21000-memory.dmp

Filesize
4KB

Download
memory/968-1-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/968-0-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/968-20-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/968-2-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/4976-21-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/4976-18-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/4976-17-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/4976-19-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download
memory/4976-50-0x0000000000400000-0x0000000000926000-memory.dmp

Filesize
5.1MB

Download

Analysis

Sharing