blackmoon | a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd

General

Target

a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe
Size

1022KB
MD5

c4cf5ef73a3ca17b193f02957424423d
SHA1

5c0dc0cea5674117516b9be22aa4d8fb97f513eb
SHA256

a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd
SHA512

014fd762c76b2f2bc09385c60589181e72a919c06c19c1572cf8e4c1a7efa359f079fa1877f76dc831739b2775ac6fd95d9386a00a64b9486b11d42c23e78313
SSDEEP

24576:8CQY70aWmbMM6KEUZ2iQ/mg1PR7Af9xu:8ZmUKE6sTAl

Score

10^/10

blackmoon banker discovery trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 6 IoCs

resource	yara_rule
behavioral2/memory/2136-0-0x00000000024E0000-0x0000000002510000-memory.dmp	family_blackmoon
behavioral2/memory/2136-5-0x00000000024E0000-0x0000000002510000-memory.dmp	family_blackmoon
behavioral2/memory/3516-6-0x0000000000700000-0x0000000000730000-memory.dmp	family_blackmoon
behavioral2/memory/3516-8-0x0000000000700000-0x0000000000730000-memory.dmp	family_blackmoon
behavioral2/memory/512-9-0x00000000022A0000-0x00000000022D0000-memory.dmp	family_blackmoon
behavioral2/memory/512-12-0x00000000022A0000-0x00000000022D0000-memory.dmp	family_blackmoon

Executes dropped EXE 2 IoCs

pid	Process
3516	GFyQRIuY.exe
512	GFyQRIuY.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/512-11-0x0000000000850000-0x000000000085B000-memory.dmp	upx
behavioral2/memory/512-10-0x0000000000850000-0x000000000085B000-memory.dmp	upx
behavioral2/memory/512-13-0x0000000000850000-0x000000000085B000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\GFyQRIuY.exe	a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe
File opened for modification	C:\Program Files (x86)\GFyQRIuY.exe	a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GFyQRIuY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GFyQRIuY.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2136	a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe
2136	a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe
3516	GFyQRIuY.exe
3516	GFyQRIuY.exe
3516	GFyQRIuY.exe
3516	GFyQRIuY.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2136	a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe
2136	a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe
3516	GFyQRIuY.exe
3516	GFyQRIuY.exe
512	GFyQRIuY.exe
512	GFyQRIuY.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 3516	2136	a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe	88
PID 2136 wrote to memory of 3516	2136	a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe	88
PID 2136 wrote to memory of 3516	2136	a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe	88
PID 3516 wrote to memory of 512	3516	GFyQRIuY.exe	89
PID 3516 wrote to memory of 512	3516	GFyQRIuY.exe	89
PID 3516 wrote to memory of 512	3516	GFyQRIuY.exe	89

C:\Users\Admin\AppData\Local\Temp\a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe
"C:\Users\Admin\AppData\Local\Temp\a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Program Files (x86)\GFyQRIuY.exe
  ouQBxAwl GdVLIMwrSzOgzOKa
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Program Files (x86)\GFyQRIuY.exe
    VXTpasGY UOxwaWwZ mgVCNzoK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GFyQRIuY.exe

Filesize
1022KB

MD5
c4cf5ef73a3ca17b193f02957424423d

SHA1
5c0dc0cea5674117516b9be22aa4d8fb97f513eb

SHA256
a0fed57364d6b1a9edfa1eeee9462dd9dcb9a02552b7d1276251264c2cf297dd

SHA512
014fd762c76b2f2bc09385c60589181e72a919c06c19c1572cf8e4c1a7efa359f079fa1877f76dc831739b2775ac6fd95d9386a00a64b9486b11d42c23e78313

Download Submit
memory/512-9-0x00000000022A0000-0x00000000022D0000-memory.dmp

Filesize
192KB

Download
memory/512-11-0x0000000000850000-0x000000000085B000-memory.dmp

Filesize
44KB

Download
memory/512-10-0x0000000000850000-0x000000000085B000-memory.dmp

Filesize
44KB

Download
memory/512-12-0x00000000022A0000-0x00000000022D0000-memory.dmp

Filesize
192KB

Download
memory/512-13-0x0000000000850000-0x000000000085B000-memory.dmp

Filesize
44KB

Download
memory/2136-0-0x00000000024E0000-0x0000000002510000-memory.dmp

Filesize
192KB

Download
memory/2136-5-0x00000000024E0000-0x0000000002510000-memory.dmp

Filesize
192KB

Download
memory/3516-6-0x0000000000700000-0x0000000000730000-memory.dmp

Filesize
192KB

Download
memory/3516-8-0x0000000000700000-0x0000000000730000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing