blackmoon | 9f8cea1485e1ef8d538f18d5d72bd62175e754cf8619812b457149178953f363

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f8cea1485e1ef8d538f18d5d72bd62175e754cf8619812b457149178953f363N.exe
Size

366KB
MD5

9b3b6d1b9f2949abc72e55d0556905b0
SHA1

263263ea19b86182ca068ae385fd9e4ba59b45a2
SHA256

9f8cea1485e1ef8d538f18d5d72bd62175e754cf8619812b457149178953f363
SHA512

2db3873955868c959055873bce5d053d6925c9e3750f4b1362d50082d2cf2e13f82caa77af49969b5687a2b60879e3511d23e53e0920498d9346288d162d3b7c
SSDEEP

6144:BSfSHl+gv5gY1F53Aul/Egv4+E6qnwEGvIkJ7G9P1W:B2SHl+gv5gY1b5Eo4+EsEEIkJ7G9P1W

Score

10^/10

blackmoon banker discovery trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000016cab-13.dat	family_blackmoon

Deletes itself 1 IoCs

pid	Process
2572	Syslemsghmv.exe

Executes dropped EXE 1 IoCs

pid	Process
2572	Syslemsghmv.exe

Loads dropped DLL 2 IoCs

pid	Process
2640	9f8cea1485e1ef8d538f18d5d72bd62175e754cf8619812b457149178953f363N.exe
2640	9f8cea1485e1ef8d538f18d5d72bd62175e754cf8619812b457149178953f363N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9f8cea1485e1ef8d538f18d5d72bd62175e754cf8619812b457149178953f363N.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
2640	9f8cea1485e1ef8d538f18d5d72bd62175e754cf8619812b457149178953f363N.exe
2640	9f8cea1485e1ef8d538f18d5d72bd62175e754cf8619812b457149178953f363N.exe
2640	9f8cea1485e1ef8d538f18d5d72bd62175e754cf8619812b457149178953f363N.exe
2640	9f8cea1485e1ef8d538f18d5d72bd62175e754cf8619812b457149178953f363N.exe
2640	9f8cea1485e1ef8d538f18d5d72bd62175e754cf8619812b457149178953f363N.exe
2640	9f8cea1485e1ef8d538f18d5d72bd62175e754cf8619812b457149178953f363N.exe
2640	9f8cea1485e1ef8d538f18d5d72bd62175e754cf8619812b457149178953f363N.exe
2640	9f8cea1485e1ef8d538f18d5d72bd62175e754cf8619812b457149178953f363N.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe
2572	Syslemsghmv.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2572	2640	9f8cea1485e1ef8d538f18d5d72bd62175e754cf8619812b457149178953f363N.exe	31
PID 2640 wrote to memory of 2572	2640	9f8cea1485e1ef8d538f18d5d72bd62175e754cf8619812b457149178953f363N.exe	31
PID 2640 wrote to memory of 2572	2640	9f8cea1485e1ef8d538f18d5d72bd62175e754cf8619812b457149178953f363N.exe	31
PID 2640 wrote to memory of 2572	2640	9f8cea1485e1ef8d538f18d5d72bd62175e754cf8619812b457149178953f363N.exe	31

C:\Users\Admin\AppData\Local\Temp\9f8cea1485e1ef8d538f18d5d72bd62175e754cf8619812b457149178953f363N.exe
"C:\Users\Admin\AppData\Local\Temp\9f8cea1485e1ef8d538f18d5d72bd62175e754cf8619812b457149178953f363N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Users\Admin\AppData\Local\Temp\Syslemsghmv.exe
  "C:\Users\Admin\AppData\Local\Temp\Syslemsghmv.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Syslemsghmv.exe

Filesize
366KB

MD5
90ce00c8dc40082eb916da38c47973a8

SHA1
569a3b4701171c32246efa084d047113641fdb3e

SHA256
50e6c2515b6d3469d860b847a74ae6ef7fcd4dc891e8d5dc2ff9a5deff7f885f

SHA512
3dc7a047a0702098c59fc89521c315f80acd7cfe0a3ce428882f3ef88a087edce9b0dc0dcf426c4516e206b8d8b6d164cd2d1a6fdd09729db965f9c73de80bca

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpath.ini

Filesize
103B

MD5
3d9619471fbc0a8a84d71f3d6d1193a3

SHA1
e7106312a1177bfcf61f542190e18d91c01f0dbd

SHA256
89cccc6fbcb897ddfeaf82329bdb5d40c9a2dccc2fa6c1c03be892b53b49dc93

SHA512
a619d915b493fa72b972304f5d34851f6aa8a9c8aed5ed670939e48f30770e45508a65eefbfdd237fc352d64b047b8e4a50d99be7080882f6e60ea26e3160702

Download Submit