blackmoon | cdb5727eaec08f98f3eae94cc3df88b92bb97d2079a44466b61cd4d632d6172a

General

Target

6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Size

60KB
MD5

6fdc949f9df9b1f96b6becb5028c3065
SHA1

4868e9c88788f489dfec0ba7cc035141bdbb94fc
SHA256

cdb5727eaec08f98f3eae94cc3df88b92bb97d2079a44466b61cd4d632d6172a
SHA512

3b84c4f470e3693192493e1b336f12e4d5d959236bbf5b61972b2d312031f367db4e6e541bd06db95f7102136afd36183c66e90322e7208682e8745986aab80c
SSDEEP

1536:Ux8XWoln1KWVwIKCCFDeKaJstZHlyZu3OdeVAl6Is:Uxgl0rOCpHaJaZHlv3OqENs

Score

10^/10

blackmoon banker discovery trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral2/memory/2932-6-0x0000000000400000-0x0000000000436000-memory.dmp	family_blackmoon

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2932-0-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/2932-6-0x0000000000400000-0x0000000000436000-memory.dmp	upx

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Documents and Settings\All Users\¡¸¿ªÊ¼¡¹²Ëµ¥\³ÌÐò\Æô¶¯\desktop.ini	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\system.exe	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\system.exe	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4360	2932	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ini	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ini\DefaultIcon\ = "D:\\Downloads\\system.exe,0"	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\url\|chm\Shell\Open\Command	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\url\|chm\Shell	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\url\|chm\Shell\Open	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\url\|chm\DefaultIcon	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.url	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ini\Shell\Open\Command	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ini\Shell	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ini\DefaultIcon	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ini\ = "ini"	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\url\|chm	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\url\|chm\Shell\Open\Command\ = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\system.exe\" \"%1\""	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.chm\ = "url\|chm"	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\url\|chm\DefaultIcon\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\system.exe,0"	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ini\	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\ini\EditFlags = "2"	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ini\Shell\Open	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ini\Shell\Open\Command\ = "\"D:\\Downloads\\system.exe\" \"%1\""	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ini	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\url\|chm\	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\url\|chm\EditFlags = "2"	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.URL\ = "url\|chm"	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.chm	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe

Runs .reg file with regedit 2 IoCs

pid	Process
3332	regedit.exe
2252	regedit.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2932	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Token: SeDebugPrivilege	2932	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2252	2932	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe	86
PID 2932 wrote to memory of 2252	2932	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe	86
PID 2932 wrote to memory of 2252	2932	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe	86
PID 2932 wrote to memory of 3332	2932	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe	87
PID 2932 wrote to memory of 3332	2932	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe	87
PID 2932 wrote to memory of 3332	2932	6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\1.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:2252
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\2.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:3332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 632
  2⤵
  - Program crash
  PID:4360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2932 -ip 2932
1⤵
PID:4432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\1.reg

Filesize
312B

MD5
e532a7a5500ac88686f2652774d20cad

SHA1
c66cf1e777652669db90e7b41edc789b91f9bc6f

SHA256
2cbcd42cde6691a33857e2511ec64daffa3896a1260bcdae088d7b4a34c45bbd

SHA512
60b6f0d4b7f1a4ce082855258f97939bbaec4e52f0340e2b10ca587ebf6715b5402cb37f160b8a98734875fc3a7fb2f51148a39e047daa01deb47f5539fdcd07

Download Submit
C:\2.reg

Filesize
670B

MD5
fe7497d77714bc0841d55d07da45d12d

SHA1
b45ca6abe83f887248e61df81b8f8dfe49ba146d

SHA256
c1178ead6d2aba64f24ba246b6aeeacd366101a91ec706a1563144050c9e6f77

SHA512
9d59076bd0cfd483e6d973c43df95efb8a9bd0d7e58a7ab18b75df7bd1c2aaf85b9bff45b60d151420c2716314d81178333ed33b7400c38e22141e91d18e6e6c

Download Submit
memory/2932-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2932-6-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing