blackmoon | 0c0233485fb1b4a83c8e73d889f2bd21c5b4271b63e8343625412d97cf6ddc81

General

Target

0c0233485fb1b4a83c8e73d889f2bd21c5b4271b63e8343625412d97cf6ddc81.exe
Size

676KB
MD5

bd8f6a68e9bab31cab60ac88fd307310
SHA1

4c6ca10b196448fd85d7979b15dda32ba23e2417
SHA256

0c0233485fb1b4a83c8e73d889f2bd21c5b4271b63e8343625412d97cf6ddc81
SHA512

199ac6702c5f6bb8460ff5ba3484aa1cf3455393aa9ab9ccc863571ed3a6e7b6ef335f8a7bf925f020e501f664c4561fdaa4f49a5962d712d496ad114e9af8a3
SSDEEP

12288:bg8fK/r8bYZYCtOhzodMDPStM8ePO2S4McLs:c8Gr8bYeCtOhzo6D2MG2Js

Score

10^/10

blackmoon aspackv2 banker discovery persistence trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4976-0-0x0000000000400000-0x00000000004B3000-memory.dmp	family_blackmoon
behavioral2/memory/4976-19-0x0000000000400000-0x00000000004B3000-memory.dmp	family_blackmoon

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

WinDos.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\iQNjPQVmZxf\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\iQNjPQVmZxf"	WinDos.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\ZyOerf.exe	aspack_v212_v242

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

ZyOerf.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation ZyOerf.exe
Executes dropped EXE 2 IoCs

Processes:

ZyOerf.exeWinDos.exe

pid process

3012 ZyOerf.exe
2472 WinDos.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	ZyOerf.exe

pid	process
3012	ZyOerf.exe
2472	WinDos.exe

Drops file in Program Files directory 64 IoCs

Processes:

ZyOerf.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	ZyOerf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	ZyOerf.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\chrmstp.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	ZyOerf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	ZyOerf.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	ZyOerf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	ZyOerf.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	ZyOerf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	ZyOerf.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	ZyOerf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	ZyOerf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	ZyOerf.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe	ZyOerf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	ZyOerf.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	ZyOerf.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	ZyOerf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	ZyOerf.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.106\notification_helper.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	ZyOerf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	ZyOerf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	ZyOerf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	ZyOerf.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	ZyOerf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

0c0233485fb1b4a83c8e73d889f2bd21c5b4271b63e8343625412d97cf6ddc81.exeZyOerf.execmd.exetaskkill.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0c0233485fb1b4a83c8e73d889f2bd21c5b4271b63e8343625412d97cf6ddc81.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZyOerf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2608 taskkill.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

WinDos.exe

pid process

2472 WinDos.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

WinDos.exetaskkill.exe

description pid process

Token: SeLoadDriverPrivilege 2472 WinDos.exe
Token: SeDebugPrivilege 2608 taskkill.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

0c0233485fb1b4a83c8e73d889f2bd21c5b4271b63e8343625412d97cf6ddc81.exe

pid process

4976 0c0233485fb1b4a83c8e73d889f2bd21c5b4271b63e8343625412d97cf6ddc81.exe

pid	process
2608	taskkill.exe

pid	process
2472	WinDos.exe

description	pid	process
Token: SeLoadDriverPrivilege	2472	WinDos.exe
Token: SeDebugPrivilege	2608	taskkill.exe

pid	process
4976	0c0233485fb1b4a83c8e73d889f2bd21c5b4271b63e8343625412d97cf6ddc81.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

0c0233485fb1b4a83c8e73d889f2bd21c5b4271b63e8343625412d97cf6ddc81.execmd.exeZyOerf.exe

description	pid	process	target process
PID 4976 wrote to memory of 3012	4976	0c0233485fb1b4a83c8e73d889f2bd21c5b4271b63e8343625412d97cf6ddc81.exe	ZyOerf.exe
PID 4976 wrote to memory of 3012	4976	0c0233485fb1b4a83c8e73d889f2bd21c5b4271b63e8343625412d97cf6ddc81.exe	ZyOerf.exe
PID 4976 wrote to memory of 3012	4976	0c0233485fb1b4a83c8e73d889f2bd21c5b4271b63e8343625412d97cf6ddc81.exe	ZyOerf.exe
PID 4976 wrote to memory of 2472	4976	0c0233485fb1b4a83c8e73d889f2bd21c5b4271b63e8343625412d97cf6ddc81.exe	WinDos.exe
PID 4976 wrote to memory of 2472	4976	0c0233485fb1b4a83c8e73d889f2bd21c5b4271b63e8343625412d97cf6ddc81.exe	WinDos.exe
PID 4976 wrote to memory of 3876	4976	0c0233485fb1b4a83c8e73d889f2bd21c5b4271b63e8343625412d97cf6ddc81.exe	cmd.exe
PID 4976 wrote to memory of 3876	4976	0c0233485fb1b4a83c8e73d889f2bd21c5b4271b63e8343625412d97cf6ddc81.exe	cmd.exe
PID 4976 wrote to memory of 3876	4976	0c0233485fb1b4a83c8e73d889f2bd21c5b4271b63e8343625412d97cf6ddc81.exe	cmd.exe
PID 3876 wrote to memory of 2608	3876	cmd.exe	taskkill.exe
PID 3876 wrote to memory of 2608	3876	cmd.exe	taskkill.exe
PID 3876 wrote to memory of 2608	3876	cmd.exe	taskkill.exe
PID 3012 wrote to memory of 2088	3012	ZyOerf.exe	cmd.exe
PID 3012 wrote to memory of 2088	3012	ZyOerf.exe	cmd.exe
PID 3012 wrote to memory of 2088	3012	ZyOerf.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\0c0233485fb1b4a83c8e73d889f2bd21c5b4271b63e8343625412d97cf6ddc81.exe
"C:\Users\Admin\AppData\Local\Temp\0c0233485fb1b4a83c8e73d889f2bd21c5b4271b63e8343625412d97cf6ddc81.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976

C:\Users\Admin\AppData\Local\Temp\ZyOerf.exe
C:\Users\Admin\AppData\Local\Temp\ZyOerf.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3012

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\71623c8c.bat" "
3⤵
- System Location Discovery: System Language Discovery
PID:2088

C:\Users\Admin\AppData\Local\Temp\WinDos.exe
C:\Users\Admin\AppData\Local\Temp\WinDos.exe C:\Users\Admin\AppData\Local\Temp\isr.sys
2⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2472

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\1.bat
2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3876

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM WmiPrvSE.exe
3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.bat

Filesize
126B

MD5
a35389ee8a311570bf047f784a1680b6

SHA1
f3c0aac747bbef4d349da9b843d6811fa5e6816b

SHA256
c73137478dcf5132e851006476da2d90add1817cb24421027c9d6b7b3cffdafe

SHA512
aa8c34ed2560139d409a96e540a825947acf95bb93606098ec24e714eb03d50d5bd3cd974de08546e5d98a859fc41864da946281ef036e06a879230d4354e207

Download Submit
C:\Users\Admin\AppData\Local\Temp\71623c8c.bat

Filesize
187B

MD5
4e91595bd01502d1e65ce592c8f4e14d

SHA1
6517117a184531d3108d8ae6263de1f96201a307

SHA256
f63ab1e0ab947f944623208e8a6e3c24b51a18bb003aaa82b294c40dd2326ece

SHA512
9686d0073415b459ed3781e26a93218c4e0782fd08c3dfeb2db7d48b7b7d91c506d9395a468be458b0ddcfa5dce9e3a44e8af22eae9a16ec5d6fdd4332f8c4fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinDos.exe

Filesize
134KB

MD5
3f69bcd2ab365cbd2ac3328b99123b83

SHA1
deb65ebfe716db9eb95ce4630c4b124e9f68618f

SHA256
49e79e780bdffbb236c7ec8fd08069330cf80ca37b5846f9d909631e10ebbce5

SHA512
ea6c7faa6bb2e13df24e0b195e300b9cce0b8a7b67a131352dedf97d8f5166d0523a646c676d6b5e1a1a4160752a10ca8490f09f1817b916df8b175c6e71c793

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZyOerf.exe

Filesize
15KB

MD5
f7d21de5c4e81341eccd280c11ddcc9a

SHA1
d4e9ef10d7685d491583c6fa93ae5d9105d815bd

SHA256
4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794

SHA512
e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3

Download Submit
memory/3012-5-0x0000000000FA0000-0x0000000000FA9000-memory.dmp

Filesize
36KB

Download
memory/3012-24-0x0000000000FA0000-0x0000000000FA9000-memory.dmp

Filesize
36KB

Download
memory/4976-0-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4976-19-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads