blackmoon | 4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35

General

Target

4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
Size

9.4MB
MD5

fec06a55f3d891205feae67542e26a4c
SHA1

058d02466d8c1a9a6d581e8be80770138a3814e9
SHA256

4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35
SHA512

d2b078debba67b059170562eef980325c08fb262825e27a5141f2e6cf6cf7a00c17d7f56891e83bebdf726215f5819a85f9063e10722b91c1dc655628e4f7ca9
SSDEEP

196608:10/mS/lrNDbtXRd6SdJN75tLj/B1DW/RG768DIbIKXDXu0RBBY1F3B9pjTg:iO0lFbN6ydLj/L768EkKzXuABB2B9pjU

Score

10^/10

blackmoon banker discovery trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 10 IoCs

resource	yara_rule
behavioral1/memory/2936-6-0x0000000000400000-0x00000000009FA000-memory.dmp	family_blackmoon
behavioral1/memory/2936-7-0x0000000000400000-0x00000000009FA000-memory.dmp	family_blackmoon
behavioral1/memory/2936-9-0x0000000000400000-0x00000000009FA000-memory.dmp	family_blackmoon
behavioral1/memory/2936-8-0x0000000000400000-0x00000000009FA000-memory.dmp	family_blackmoon
behavioral1/memory/2936-23-0x0000000000400000-0x00000000009FA000-memory.dmp	family_blackmoon
behavioral1/memory/3032-29-0x0000000000400000-0x00000000009FA000-memory.dmp	family_blackmoon
behavioral1/memory/3032-31-0x0000000000400000-0x00000000009FA000-memory.dmp	family_blackmoon
behavioral1/memory/3032-42-0x0000000000400000-0x00000000009FA000-memory.dmp	family_blackmoon
behavioral1/memory/3032-53-0x0000000000400000-0x00000000009FA000-memory.dmp	family_blackmoon
behavioral1/memory/3032-56-0x0000000000400000-0x00000000009FA000-memory.dmp	family_blackmoon

Executes dropped EXE 1 IoCs

pid	Process
3032	279454abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe

Loads dropped DLL 1 IoCs

pid	Process
2936	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
File opened (read-only)	\??\N:	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
File opened (read-only)	\??\Q:	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
File opened (read-only)	\??\R:	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
File opened (read-only)	\??\W:	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
File opened (read-only)	\??\Y:	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
File opened (read-only)	\??\B:	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
File opened (read-only)	\??\K:	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
File opened (read-only)	\??\U:	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
File opened (read-only)	\??\Z:	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
File opened (read-only)	\??\A:	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
File opened (read-only)	\??\H:	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
File opened (read-only)	\??\I:	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
File opened (read-only)	\??\J:	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
File opened (read-only)	\??\S:	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
File opened (read-only)	\??\X:	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
File opened (read-only)	\??\E:	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
File opened (read-only)	\??\M:	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
File opened (read-only)	\??\O:	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
File opened (read-only)	\??\P:	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
File opened (read-only)	\??\T:	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
File opened (read-only)	\??\V:	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
File opened (read-only)	\??\G:	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	279454abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	279454abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2936	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
2936	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
2936	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
3032	279454abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
3032	279454abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
3032	279454abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 3032	2936	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe	30
PID 2936 wrote to memory of 3032	2936	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe	30
PID 2936 wrote to memory of 3032	2936	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe	30
PID 2936 wrote to memory of 3032	2936	4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe	30

C:\Users\Admin\AppData\Local\Temp\4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
"C:\Users\Admin\AppData\Local\Temp\4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936
- C:\À×öª ¡¤ ¢ÚºÏÒ»Çå·çÖ®Õ½\279454abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe
  "C:\À×öª ¡¤ ¢ÚºÏÒ»Çå·çÖ®Õ½\279454abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a2568c776935a3b306efc5befe584493.txt

Filesize
26B

MD5
03871ac9683ba9329d073dfc4431f4e2

SHA1
43c491582df9acfda860a39dcdc2427153508973

SHA256
fd93b5c10a79b4b0b9617940d8221b9ee8d06d0b717d0077209c3ae7f6d2f843

SHA512
ede15fccd5c96aaefa71088e07a31955ce3cf2141836fa03691b27adddf502095edde1b98d17c0da4e86a2eb2655b0c4c883a1fc7f7f09ee9195be1a2825bf83

Download Submit
\À×öª ¡¤ ¢ÚºÏÒ»Çå·çÖ®Õ½\279454abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35.exe

Filesize
9.4MB

MD5
fec06a55f3d891205feae67542e26a4c

SHA1
058d02466d8c1a9a6d581e8be80770138a3814e9

SHA256
4abbc34a815105605889a5ca7a686db285d9be6d0b5a1985a050c98771aa0c35

SHA512
d2b078debba67b059170562eef980325c08fb262825e27a5141f2e6cf6cf7a00c17d7f56891e83bebdf726215f5819a85f9063e10722b91c1dc655628e4f7ca9

Download Submit
memory/2936-23-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/2936-22-0x000000000B320000-0x000000000B91A000-memory.dmp

Filesize
6.0MB

Download
memory/2936-7-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/2936-9-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/2936-8-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/2936-5-0x00000000004FF000-0x0000000000500000-memory.dmp

Filesize
4KB

Download
memory/2936-0-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/2936-1-0x00000000003B0000-0x00000000003B3000-memory.dmp

Filesize
12KB

Download
memory/2936-21-0x00000000003B0000-0x00000000003B3000-memory.dmp

Filesize
12KB

Download
memory/2936-6-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/3032-25-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/3032-29-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/3032-31-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/3032-42-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/3032-24-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/3032-53-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/3032-56-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download

Analysis

Sharing