blackmoon | a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd

General

Target

a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe
Size

1022KB
MD5

c4cf5ef73a3ca17b193f02957424423d
SHA1

5c0dc0cea5674117516b9be22aa4d8fb97f513eb
SHA256

a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd
SHA512

014fd762c76b2f2bc09385c60589181e72a919c06c19c1572cf8e4c1a7efa359f079fa1877f76dc831739b2775ac6fd95d9386a00a64b9486b11d42c23e78313
SSDEEP

24576:8CQY70aWmbMM6KEUZ2iQ/mg1PR7Af9xu:8ZmUKE6sTAl

Score

10^/10

blackmoon banker discovery trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 6 IoCs

resource	yara_rule
behavioral1/memory/2296-1-0x00000000006B0000-0x00000000006E0000-memory.dmp	family_blackmoon
behavioral1/memory/2296-8-0x00000000006B0000-0x00000000006E0000-memory.dmp	family_blackmoon
behavioral1/memory/300-10-0x00000000002F0000-0x0000000000320000-memory.dmp	family_blackmoon
behavioral1/memory/300-14-0x00000000002F0000-0x0000000000320000-memory.dmp	family_blackmoon
behavioral1/memory/2984-15-0x00000000002E0000-0x0000000000310000-memory.dmp	family_blackmoon
behavioral1/memory/2984-18-0x00000000002E0000-0x0000000000310000-memory.dmp	family_blackmoon

Executes dropped EXE 2 IoCs

pid	Process
300	GFyQRIuY.exe
2984	GFyQRIuY.exe

Loads dropped DLL 3 IoCs

pid	Process
2296	a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe
2296	a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe
300	GFyQRIuY.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2984-17-0x00000000003E0000-0x00000000003EB000-memory.dmp	upx
behavioral1/memory/2984-16-0x00000000003E0000-0x00000000003EB000-memory.dmp	upx
behavioral1/memory/2984-19-0x00000000003E0000-0x00000000003EB000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\GFyQRIuY.exe	a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe
File opened for modification	C:\Program Files (x86)\GFyQRIuY.exe	a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GFyQRIuY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GFyQRIuY.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2296	a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe
300	GFyQRIuY.exe
300	GFyQRIuY.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2296	a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe
2296	a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe
300	GFyQRIuY.exe
300	GFyQRIuY.exe
2984	GFyQRIuY.exe
2984	GFyQRIuY.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 300	2296	a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe	30
PID 2296 wrote to memory of 300	2296	a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe	30
PID 2296 wrote to memory of 300	2296	a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe	30
PID 2296 wrote to memory of 300	2296	a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe	30
PID 300 wrote to memory of 2984	300	GFyQRIuY.exe	31
PID 300 wrote to memory of 2984	300	GFyQRIuY.exe	31
PID 300 wrote to memory of 2984	300	GFyQRIuY.exe	31
PID 300 wrote to memory of 2984	300	GFyQRIuY.exe	31

C:\Users\Admin\AppData\Local\Temp\a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe
"C:\Users\Admin\AppData\Local\Temp\a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\GFyQRIuY.exe
  AlpxXODL GdVLIMwroOsHPAXF
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:300
- - C:\Program Files (x86)\GFyQRIuY.exe
    ecOnCyNy UOxwaWwZ vCkGdDet
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GFyQRIuY.exe

Filesize
1022KB

MD5
c4cf5ef73a3ca17b193f02957424423d

SHA1
5c0dc0cea5674117516b9be22aa4d8fb97f513eb

SHA256
a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd

SHA512
014fd762c76b2f2bc09385c60589181e72a919c06c19c1572cf8e4c1a7efa359f079fa1877f76dc831739b2775ac6fd95d9386a00a64b9486b11d42c23e78313

Download Submit
memory/300-10-0x00000000002F0000-0x0000000000320000-memory.dmp

Filesize
192KB

Download
memory/300-14-0x00000000002F0000-0x0000000000320000-memory.dmp

Filesize
192KB

Download
memory/2296-1-0x00000000006B0000-0x00000000006E0000-memory.dmp

Filesize
192KB

Download
memory/2296-8-0x00000000006B0000-0x00000000006E0000-memory.dmp

Filesize
192KB

Download
memory/2984-15-0x00000000002E0000-0x0000000000310000-memory.dmp

Filesize
192KB

Download
memory/2984-17-0x00000000003E0000-0x00000000003EB000-memory.dmp

Filesize
44KB

Download
memory/2984-16-0x00000000003E0000-0x00000000003EB000-memory.dmp

Filesize
44KB

Download
memory/2984-18-0x00000000002E0000-0x0000000000310000-memory.dmp

Filesize
192KB

Download
memory/2984-19-0x00000000003E0000-0x00000000003EB000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing