blackmoon | 97d1f96fc0b6f143e003389c52edb73442169f7b98cf4eed16a97bc8cb196124

Analysis

max time kernel
145s
max time network
145s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 23:24 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

造梦西游5魂殇修改器.exe
Size

468KB
MD5

59d71e81bca65c7f790d33d317dbe4cc
SHA1

01fa3b6561274da9d1c5550679e092033a3bb2af
SHA256

fe5fa6f567d0d5b03e1e38d922fbbfab5f687e2192ffc0585c87dea14f00146c
SHA512

d7a6990b6298e812ca014521a2a4a0976654eb8fb9d0a4911a1576f37b393d70a7f245e9b52aa074e1c3d9fe917093319f32c70017eb7e911f3937be67d4ff21
SSDEEP

6144:6a4f07to4inSxvRUNzasgXO88SqER3GsAp5/pv:N4f0a4iSxgzasgP75RNA

Score

10^/10

blackmoon banker discovery trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral3/files/0x000e00000001418b-1.dat	family_blackmoon

Executes dropped EXE 1 IoCs

pid	Process
2628	ÔìÃÎÎ÷ÓÎ4»êéäÐÞ¸ÄÆ÷6.3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	造梦西游5魂殇修改器.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ÔìÃÎÎ÷ÓÎ4»êéäÐÞ¸ÄÆ÷6.3.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{86786461-8115-11EF-A1FD-CAD9DE6C860B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000005c95cf5c04a08fcd81c95b28466bab75f6b0553cc2678c3dbbafe56dbbc5419e000000000e800000000200002000000030444ee427bacb7b3847054338b0d9d108ce458c29185cfbbf1d0ae07e581de6200000001f2d42c7bd7c7b585011ee6be0c9af7e1425c96649b3d39a4c35f6dae35ffc2740000000a154beec17c408e691282766e6aaf6c0290b481a5efbd534c2474d4b035e00b72177549cd24fb1a6314d583642d3359e7d809dc9b0ccb9dae4d308c474667cd1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80ecb25d2215db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434073367"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000007b7305924bf457acb1e3fecca070f10694a60745479faf04fabdc35a13637437000000000e8000000002000020000000d40c82a98a7a0eb95207ea5434102945760a6918c233a8715c4745e87c644d259000000036a328304f4b5a1abc5f53fe50d3a39ab341bbad5a23faceff020972df27e117ba311b56c02cb9b31318d979879fba78d0043ab1b8276cd98c5cd62bf2bfbd5a1c3dd9cfc39de09e5939a5be6a6f4a2debd2ef7ed22e930e3228f70a894194a8bc93a5741d7fec0d42fbb6d6172dcf9211175242413355aa70e5f0d171420a1aa96b094739f4a0b98c47e64580ff0518400000008833e17cf736582b56ac9dca8e280e3a73e70ed0e2f39612a54fd4aa49006670778fa2ea5e5657b51fd57a255f1211d7823ca04493c79233dbe63a9e46e2f287	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1088	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2096	造梦西游5魂殇修改器.exe
2628	ÔìÃÎÎ÷ÓÎ4»êéäÐÞ¸ÄÆ÷6.3.exe
1088	iexplore.exe
1088	iexplore.exe
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2112	2096	造梦西游5魂殇修改器.exe	31
PID 2096 wrote to memory of 2112	2096	造梦西游5魂殇修改器.exe	31
PID 2096 wrote to memory of 2112	2096	造梦西游5魂殇修改器.exe	31
PID 2096 wrote to memory of 2112	2096	造梦西游5魂殇修改器.exe	31
PID 2448 wrote to memory of 2628	2448	explorer.exe	33
PID 2448 wrote to memory of 2628	2448	explorer.exe	33
PID 2448 wrote to memory of 2628	2448	explorer.exe	33
PID 2448 wrote to memory of 2628	2448	explorer.exe	33
PID 2628 wrote to memory of 1088	2628	ÔìÃÎÎ÷ÓÎ4»êéäÐÞ¸ÄÆ÷6.3.exe	35
PID 2628 wrote to memory of 1088	2628	ÔìÃÎÎ÷ÓÎ4»êéäÐÞ¸ÄÆ÷6.3.exe	35
PID 2628 wrote to memory of 1088	2628	ÔìÃÎÎ÷ÓÎ4»êéäÐÞ¸ÄÆ÷6.3.exe	35
PID 2628 wrote to memory of 1088	2628	ÔìÃÎÎ÷ÓÎ4»êéäÐÞ¸ÄÆ÷6.3.exe	35
PID 1088 wrote to memory of 2532	1088	iexplore.exe	36
PID 1088 wrote to memory of 2532	1088	iexplore.exe	36
PID 1088 wrote to memory of 2532	1088	iexplore.exe	36
PID 1088 wrote to memory of 2532	1088	iexplore.exe	36

C:\Users\Admin\AppData\Local\Temp\造梦西游5魂殇修改器.exe
"C:\Users\Admin\AppData\Local\Temp\造梦西游5魂殇修改器.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\Explorer.exe
  Explorer /n,C:\Users\Admin\AppData\Local\Temp\ÔìÃÎÎ÷ÓÎ4»êéäÐÞ¸ÄÆ÷6.3.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2112

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Users\Admin\AppData\Local\Temp\ÔìÃÎÎ÷ÓÎ4»êéäÐÞ¸ÄÆ÷6.3.exe
  "C:\Users\Admin\AppData\Local\Temp\ÔìÃÎÎ÷ÓÎ4»êéäÐÞ¸ÄÆ÷6.3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://www.4399hs.com/
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1088
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1088 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2532

Network

DNS

1212.ip138.com

造梦西游5魂殇修改器.exe

Remote address:

8.8.8.8:53

Request

1212.ip138.com

IN A

Response

1212.ip138.com

IN CNAME

waf.ip138.com

waf.ip138.com

IN A

110.81.155.137

waf.ip138.com

IN A

59.57.13.133

waf.ip138.com

IN A

59.57.13.182

waf.ip138.com

IN A

59.57.14.11

waf.ip138.com

IN A

110.81.155.138
DNS

hunshang.oss-cn-hangzhou.aliyuncs.com

ÔìÃÎÎ÷ÓÎ4»êéäÐÞ¸ÄÆ÷6.3.exe

Remote address:

8.8.8.8:53

Request

hunshang.oss-cn-hangzhou.aliyuncs.com

IN A

Response

hunshang.oss-cn-hangzhou.aliyuncs.com

IN A

118.31.219.202
DNS

www.4399hs.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.4399hs.com

IN A

Response
DNS

ip.qq.com

造梦西游5魂殇修改器.exe

Remote address:

8.8.8.8:53

Request

ip.qq.com

IN A

Response

ip.qq.com

IN A

0.0.0.1
DNS

hao.ug118.com

造梦西游5魂殇修改器.exe

Remote address:

8.8.8.8:53

Request

hao.ug118.com

IN A

Response

110.81.155.137:80

1212.ip138.com

造梦西游5魂殇修改器.exe

152 B
3
118.31.219.202:80

hunshang.oss-cn-hangzhou.aliyuncs.com

ÔìÃÎÎ÷ÓÎ4»êéäÐÞ¸ÄÆ÷6.3.exe

152 B
3
110.81.155.137:80

1212.ip138.com

造梦西游5魂殇修改器.exe

152 B
3
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

799 B
7.8kB
10
12
204.79.197.200:443

ieonline.microsoft.com

iexplore.exe

152 B
3
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

779 B
7.7kB
9
11

8.8.8.8:53

1212.ip138.com

dns

造梦西游5魂殇修改器.exe

60 B
158 B
1
1

DNS Request

1212.ip138.com

DNS Response

110.81.155.137

59.57.13.133

59.57.13.182

59.57.14.11

110.81.155.138
8.8.8.8:53

hunshang.oss-cn-hangzhou.aliyuncs.com

dns

ÔìÃÎÎ÷ÓÎ4»êéäÐÞ¸ÄÆ÷6.3.exe

83 B
99 B
1
1

DNS Request

hunshang.oss-cn-hangzhou.aliyuncs.com

DNS Response

118.31.219.202
8.8.8.8:53

www.4399hs.com

dns

IEXPLORE.EXE

60 B
133 B
1
1

DNS Request

www.4399hs.com
8.8.8.8:53

ip.qq.com

dns

造梦西游5魂殇修改器.exe

55 B
71 B
1
1

DNS Request

ip.qq.com

DNS Response

0.0.0.1
8.8.8.8:53

hao.ug118.com

dns

造梦西游5魂殇修改器.exe

59 B
139 B
1
1

DNS Request

hao.ug118.com

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
494dc467f86039707e33a9a2e63cb65e

SHA1
d50633dc815b2690f22f25cbd75abc679bed86f8

SHA256
0b56d097ed3cac5823c423232ff558ee14445d26cd62dfd1932706ad6e206ed2

SHA512
9f9d2a3bb49668a48ab63a6f9dd408e4ec237ae7a30ec7d6f1f7377d5e6d1508661b1f6c64c956e47d9cfca5dc41502c1b3a4101d1814030363003381334a247

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA372.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA3D4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ÔìÃÎÎ÷ÓÎ4»êéäÐÞ¸ÄÆ÷6.3.exe

Filesize
268KB

MD5
d4345448976df15d4338d411583217d8

SHA1
83f405499bd649c5744fe4f6eb1abea8828487dc

SHA256
6cc67524aacded7fdd197048881a68fb21278dd9e20a73b57d7a11550fc736e9

SHA512
b6ff0b28aff3663b49156d1f6e3c75dd994e3ff70a92ff7914128473ab886aedec8cd2dd6018fd99e62ad7294bb808c5c4c5ad5a6713ba41df09b0b16d960385

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.