blackmoon | 2096c404d709221eae23bdb1fbaff57d648c7d017ea97035882b9b97d55d1df1

General

Target

QQ牧场宝贝.exe
Size

283KB
MD5

4b18c843d1f5aa5c0a0511d8137fb0ca
SHA1

3b7db3134a3a15a3683a1c198c0c972c58e507b5
SHA256

842536f9891fd3842e8a6b74c667391a1e11b4a552c34414bc48f61fdbdd6c1b
SHA512

721f613673650df4c0762bf03bfd9af4b34b2f437940baa98b9cf5623eacea24b6ba820917d4dc605a539f04fd196a4794647a2cb7c82fd0c294fb600290dc2c
SSDEEP

6144:6EBLkxedjZJv+91z0/RCLIEX8494VLAJaBf04vCt7ssYInY:6cLkxe1n+Tz0/+SZXBf0ECt7ssYInY

Score

10^/10

blackmoon banker trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

resource	yara_rule
behavioral3/memory/2140-52-0x0000000000400000-0x000000000051B000-memory.dmp	family_blackmoon
behavioral3/memory/2140-105-0x0000000000400000-0x000000000051B000-memory.dmp	family_blackmoon

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/memory/2140-0-0x0000000000400000-0x000000000051B000-memory.dmp	upx
behavioral3/memory/2140-52-0x0000000000400000-0x000000000051B000-memory.dmp	upx
behavioral3/memory/2140-105-0x0000000000400000-0x000000000051B000-memory.dmp	upx

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	QQ牧场宝贝.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2140	QQ牧场宝贝.exe
2140	QQ牧场宝贝.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2140	QQ牧场宝贝.exe
2140	QQ牧场宝贝.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2140	QQ牧场宝贝.exe
2140	QQ牧场宝贝.exe
2140	QQ牧场宝贝.exe
2140	QQ牧场宝贝.exe
2140	QQ牧场宝贝.exe

C:\Users\Admin\AppData\Local\Temp\QQ牧场宝贝.exe
"C:\Users\Admin\AppData\Local\Temp\QQ牧场宝贝.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A8DU897P\errorPageStrings[2]

Filesize
2KB

MD5
e3e4a98353f119b80b323302f26b78fa

SHA1
20ee35a370cdd3a8a7d04b506410300fd0a6a864

SHA256
9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

SHA512
d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

Download Submit
memory/2140-25-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-39-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-49-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-23-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-45-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-44-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-41-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-21-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-37-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-35-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-33-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-31-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-51-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2140-19-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-27-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-0-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/2140-47-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-50-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-29-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-17-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-15-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-13-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-11-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-9-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-8-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2140-7-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-3-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-52-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/2140-53-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-54-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2140-77-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2140-1-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2140-105-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing