blackmoon | 53c464289a2b40e05ab2ba637a6a2c021ae447b05786bde5b9e6eedcbdd21b9d

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53c464289a2b40e05ab2ba637a6a2c021ae447b05786bde5b9e6eedcbdd21b9d.exe
Size

436KB
MD5

61997f66153d1f0712c52974260cd0d7
SHA1

efc0e4842b2c94069eb9cf44c9c0ee956397f683
SHA256

53c464289a2b40e05ab2ba637a6a2c021ae447b05786bde5b9e6eedcbdd21b9d
SHA512

c731c61f4be7847d58d98c92d44a0e401b5993118035ca787894719585a67625b0a9d6ae0836238e81c23f8b867744f3c5d51dc8e3cc4596d2a41af7f66b525c
SSDEEP

6144:dGdR+Yk/N8duBmG6t+UnRsRCQ/OJZOg7J:doR+Y4NSG6oUnRsdOJZOg7J

Score

10^/10

blackmoon banker discovery trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000015e87-13.dat	family_blackmoon

Deletes itself 1 IoCs

pid	Process
2600	Syslemfjoij.exe

Executes dropped EXE 1 IoCs

pid	Process
2600	Syslemfjoij.exe

Loads dropped DLL 2 IoCs

pid	Process
2764	53c464289a2b40e05ab2ba637a6a2c021ae447b05786bde5b9e6eedcbdd21b9d.exe
2764	53c464289a2b40e05ab2ba637a6a2c021ae447b05786bde5b9e6eedcbdd21b9d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53c464289a2b40e05ab2ba637a6a2c021ae447b05786bde5b9e6eedcbdd21b9d.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2764	53c464289a2b40e05ab2ba637a6a2c021ae447b05786bde5b9e6eedcbdd21b9d.exe
2764	53c464289a2b40e05ab2ba637a6a2c021ae447b05786bde5b9e6eedcbdd21b9d.exe
2764	53c464289a2b40e05ab2ba637a6a2c021ae447b05786bde5b9e6eedcbdd21b9d.exe
2764	53c464289a2b40e05ab2ba637a6a2c021ae447b05786bde5b9e6eedcbdd21b9d.exe
2764	53c464289a2b40e05ab2ba637a6a2c021ae447b05786bde5b9e6eedcbdd21b9d.exe
2764	53c464289a2b40e05ab2ba637a6a2c021ae447b05786bde5b9e6eedcbdd21b9d.exe
2764	53c464289a2b40e05ab2ba637a6a2c021ae447b05786bde5b9e6eedcbdd21b9d.exe
2764	53c464289a2b40e05ab2ba637a6a2c021ae447b05786bde5b9e6eedcbdd21b9d.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe
2600	Syslemfjoij.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2600	2764	53c464289a2b40e05ab2ba637a6a2c021ae447b05786bde5b9e6eedcbdd21b9d.exe	32
PID 2764 wrote to memory of 2600	2764	53c464289a2b40e05ab2ba637a6a2c021ae447b05786bde5b9e6eedcbdd21b9d.exe	32
PID 2764 wrote to memory of 2600	2764	53c464289a2b40e05ab2ba637a6a2c021ae447b05786bde5b9e6eedcbdd21b9d.exe	32
PID 2764 wrote to memory of 2600	2764	53c464289a2b40e05ab2ba637a6a2c021ae447b05786bde5b9e6eedcbdd21b9d.exe	32

C:\Users\Admin\AppData\Local\Temp\53c464289a2b40e05ab2ba637a6a2c021ae447b05786bde5b9e6eedcbdd21b9d.exe
"C:\Users\Admin\AppData\Local\Temp\53c464289a2b40e05ab2ba637a6a2c021ae447b05786bde5b9e6eedcbdd21b9d.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Users\Admin\AppData\Local\Temp\Syslemfjoij.exe
  "C:\Users\Admin\AppData\Local\Temp\Syslemfjoij.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Syslemfjoij.exe

Filesize
436KB

MD5
e4b7e2f0bc3b995c089079f3c1e86f14

SHA1
9df5401cb2bec446b465b90c0c4a6c9bd1c05b74

SHA256
7110fa09553f1f1a719ae496efe93d640aac0b8e5ebd713f671fb12bcd4c6c61

SHA512
36fd93e04ff012d6a8526de89ba8001f68aeebf33e6ac2c3976bc49567863d30029d321a2faae5fa1123cb9c274a97a75f84398e66c7e41a65b4f10a071211de

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpath.ini

Filesize
102B

MD5
11ca2e701f90dfc584d1be15cc0c402d

SHA1
ebb7738e7b609bcc9404c46f6b26564cef1ee2b3

SHA256
d0102671857d1dabf412e75577a2a31137b5259a22e5e5b3947a478bb7935070

SHA512
0a7b105ed2826b192540eb5d744994c42c2afab838e16360439784812baed10b1d49e14a15408cabce3f6f3c86ab2addd1d66cde1cb25daaba7d8049913829d6

Download Submit