blackmoon | 85f575a0a5d1d0f52d5d27121b980b28f1656069ba71adeceab003b272c0b651

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 04:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85f575a0a5d1d0f52d5d27121b980b28f1656069ba71adeceab003b272c0b651.exe
Size

7.0MB
MD5

e37b5db09d7316d37eb0bbd08693e74e
SHA1

4d6bd43ba39a11713951db41c78d2a553f9c56f1
SHA256

85f575a0a5d1d0f52d5d27121b980b28f1656069ba71adeceab003b272c0b651
SHA512

f4f33881116964a3f3758614f96a6cb1fc6de87cf405fda7a4ff1695ea80d6a1681fbd631abf5e73c006236fd5e185f24f3260b45bc329b63de67f83aa0decfc
SSDEEP

196608:iuKZtcsvnr6pK0j7xma2zIZHHJp+jVqHwHiBjooyk:Etcs07xvL+jVq/ioH

Score

10^/10

blackmoon banker discovery trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 8 IoCs

resource	yara_rule
behavioral1/memory/2852-4-0x00000000029F0000-0x0000000002ABC000-memory.dmp	family_blackmoon
behavioral1/memory/3000-10-0x0000000002BB0000-0x0000000002C7C000-memory.dmp	family_blackmoon
behavioral1/memory/3000-12-0x0000000002BB0000-0x0000000002C7C000-memory.dmp	family_blackmoon
behavioral1/memory/3000-11-0x0000000002BB0000-0x0000000002C7C000-memory.dmp	family_blackmoon
behavioral1/memory/3000-13-0x0000000002BB0000-0x0000000002C7C000-memory.dmp	family_blackmoon
behavioral1/memory/3000-21-0x0000000002BB0000-0x0000000002C7C000-memory.dmp	family_blackmoon
behavioral1/memory/3000-22-0x0000000002BB0000-0x0000000002C7C000-memory.dmp	family_blackmoon
behavioral1/memory/3000-25-0x0000000002BB0000-0x0000000002C7C000-memory.dmp	family_blackmoon

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	½ÄÏ¸´¹Å[ÔÆ].exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2852-0-0x0000000000280000-0x00000000002A5000-memory.dmp	upx
behavioral1/memory/2852-1-0x0000000000400000-0x0000000000E44000-memory.dmp	upx
behavioral1/memory/2852-3-0x0000000000280000-0x00000000002A5000-memory.dmp	upx
behavioral1/memory/2852-5-0x0000000000400000-0x0000000000E44000-memory.dmp	upx
behavioral1/memory/3000-9-0x0000000000310000-0x0000000000335000-memory.dmp	upx
behavioral1/memory/3000-8-0x0000000000400000-0x0000000000E44000-memory.dmp	upx
behavioral1/memory/3000-7-0x0000000000310000-0x0000000000335000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85f575a0a5d1d0f52d5d27121b980b28f1656069ba71adeceab003b272c0b651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	½ÄÏ¸´¹Å[ÔÆ].exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2852	85f575a0a5d1d0f52d5d27121b980b28f1656069ba71adeceab003b272c0b651.exe
2852	85f575a0a5d1d0f52d5d27121b980b28f1656069ba71adeceab003b272c0b651.exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe
3000	½ÄÏ¸´¹Å[ÔÆ].exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2852	85f575a0a5d1d0f52d5d27121b980b28f1656069ba71adeceab003b272c0b651.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 3000	2852	85f575a0a5d1d0f52d5d27121b980b28f1656069ba71adeceab003b272c0b651.exe	30
PID 2852 wrote to memory of 3000	2852	85f575a0a5d1d0f52d5d27121b980b28f1656069ba71adeceab003b272c0b651.exe	30
PID 2852 wrote to memory of 3000	2852	85f575a0a5d1d0f52d5d27121b980b28f1656069ba71adeceab003b272c0b651.exe	30
PID 2852 wrote to memory of 3000	2852	85f575a0a5d1d0f52d5d27121b980b28f1656069ba71adeceab003b272c0b651.exe	30

C:\Users\Admin\AppData\Local\Temp\85f575a0a5d1d0f52d5d27121b980b28f1656069ba71adeceab003b272c0b651.exe
"C:\Users\Admin\AppData\Local\Temp\85f575a0a5d1d0f52d5d27121b980b28f1656069ba71adeceab003b272c0b651.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Users\Admin\AppData\Local\Temp\½ÄÏ¸´¹Å[ÔÆ].exe
  "C:\Users\Admin\AppData\Local\Temp\½ÄÏ¸´¹Å[ÔÆ].exe"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2852-0-0x0000000000280000-0x00000000002A5000-memory.dmp

Filesize
148KB

Download
memory/2852-1-0x0000000000400000-0x0000000000E44000-memory.dmp

Filesize
10.3MB

Download
memory/2852-3-0x0000000000280000-0x00000000002A5000-memory.dmp

Filesize
148KB

Download
memory/2852-4-0x00000000029F0000-0x0000000002ABC000-memory.dmp

Filesize
816KB

Download
memory/2852-5-0x0000000000400000-0x0000000000E44000-memory.dmp

Filesize
10.3MB

Download
memory/2852-6-0x0000000003790000-0x00000000041D4000-memory.dmp

Filesize
10.3MB

Download
memory/3000-7-0x0000000000310000-0x0000000000335000-memory.dmp

Filesize
148KB

Download
memory/3000-8-0x0000000000400000-0x0000000000E44000-memory.dmp

Filesize
10.3MB

Download
memory/3000-9-0x0000000000310000-0x0000000000335000-memory.dmp

Filesize
148KB

Download
memory/3000-10-0x0000000002BB0000-0x0000000002C7C000-memory.dmp

Filesize
816KB

Download
memory/3000-12-0x0000000002BB0000-0x0000000002C7C000-memory.dmp

Filesize
816KB

Download
memory/3000-11-0x0000000002BB0000-0x0000000002C7C000-memory.dmp

Filesize
816KB

Download
memory/3000-13-0x0000000002BB0000-0x0000000002C7C000-memory.dmp

Filesize
816KB

Download
memory/3000-21-0x0000000002BB0000-0x0000000002C7C000-memory.dmp

Filesize
816KB

Download
memory/3000-22-0x0000000002BB0000-0x0000000002C7C000-memory.dmp

Filesize
816KB

Download
memory/3000-25-0x0000000002BB0000-0x0000000002C7C000-memory.dmp

Filesize
816KB

Download