blackmoon | b636f057ca4b8f48ee0278f3a61f4a56786e292db4b352c91c88de95a49c72a1

General

Target

1811739659ba90888a17593938aad7ca_JaffaCakes118.exe
Size

147KB
MD5

1811739659ba90888a17593938aad7ca
SHA1

3d20d38e02aece1c72d7d98a95026eba6aa431df
SHA256

b636f057ca4b8f48ee0278f3a61f4a56786e292db4b352c91c88de95a49c72a1
SHA512

a277d33d42071e8c5ba9f92bae8981c3931590b4164974f470719786c2eaa051c7e1dda7f9a5d33fe5d91ae3c58ecc50cf3b8b2fb84b482213a91f3f09a10932
SSDEEP

3072:J5umPxBBtyyNeQemRTCghEkMgqtsbtlRW1wNZkaIHYvkoutV:jumPbyyNN9TCedqtsb3saNC+vkoSV

Score

10^/10

blackmoon banker defense_evasion discovery persistence trojan vmprotect

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral1/memory/2704-25-0x0000000000400000-0x0000000000443000-memory.dmp	family_blackmoon

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	1811739659ba90888a17593938aad7ca_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2328	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2812	VnrYne173.exe

Loads dropped DLL 3 IoCs

pid	Process
2704	1811739659ba90888a17593938aad7ca_JaffaCakes118.exe
2704	1811739659ba90888a17593938aad7ca_JaffaCakes118.exe
2856	rundll32.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x000f000000016d86-21.dat	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Configuring = "rundll32.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\259430895.txt,M"	rundll32.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1811739659ba90888a17593938aad7ca_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VnrYne173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2704	1811739659ba90888a17593938aad7ca_JaffaCakes118.exe
2704	1811739659ba90888a17593938aad7ca_JaffaCakes118.exe
2704	1811739659ba90888a17593938aad7ca_JaffaCakes118.exe
2704	1811739659ba90888a17593938aad7ca_JaffaCakes118.exe
2704	1811739659ba90888a17593938aad7ca_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2856	rundll32.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2812	2704	1811739659ba90888a17593938aad7ca_JaffaCakes118.exe	30
PID 2704 wrote to memory of 2812	2704	1811739659ba90888a17593938aad7ca_JaffaCakes118.exe	30
PID 2704 wrote to memory of 2812	2704	1811739659ba90888a17593938aad7ca_JaffaCakes118.exe	30
PID 2704 wrote to memory of 2812	2704	1811739659ba90888a17593938aad7ca_JaffaCakes118.exe	30
PID 2812 wrote to memory of 2856	2812	VnrYne173.exe	31
PID 2812 wrote to memory of 2856	2812	VnrYne173.exe	31
PID 2812 wrote to memory of 2856	2812	VnrYne173.exe	31
PID 2812 wrote to memory of 2856	2812	VnrYne173.exe	31
PID 2812 wrote to memory of 2856	2812	VnrYne173.exe	31
PID 2812 wrote to memory of 2856	2812	VnrYne173.exe	31
PID 2812 wrote to memory of 2856	2812	VnrYne173.exe	31
PID 2812 wrote to memory of 2692	2812	VnrYne173.exe	32
PID 2812 wrote to memory of 2692	2812	VnrYne173.exe	32
PID 2812 wrote to memory of 2692	2812	VnrYne173.exe	32
PID 2812 wrote to memory of 2692	2812	VnrYne173.exe	32
PID 2704 wrote to memory of 2328	2704	1811739659ba90888a17593938aad7ca_JaffaCakes118.exe	34
PID 2704 wrote to memory of 2328	2704	1811739659ba90888a17593938aad7ca_JaffaCakes118.exe	34
PID 2704 wrote to memory of 2328	2704	1811739659ba90888a17593938aad7ca_JaffaCakes118.exe	34
PID 2704 wrote to memory of 2328	2704	1811739659ba90888a17593938aad7ca_JaffaCakes118.exe	34

C:\Users\Admin\AppData\Local\Temp\1811739659ba90888a17593938aad7ca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1811739659ba90888a17593938aad7ca_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Users\Admin\AppData\Local\Temp\VnrYne173.exe
  C:\Users\Admin\AppData\Local\Temp\VnrYne173.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\259430895.txt,M
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2856
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\259430895.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2692
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\1811739659ba90888a17593938aad7ca_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\259430895.bat

Filesize
132B

MD5
94c81f4fa825da5f7cd0ab04a1a57fe0

SHA1
5b47232a4a31c98c935112704c6a125a874d1a57

SHA256
413d25d0266693bcfc838d8abae2ff1990399728064f8fa486db7a4cbd2ea5bb

SHA512
a63d50b52405a8c8aeefb9db349838805ec7dd50598a5a558d923301ee00d61cc98df3fc71e716e81be38b017f0c9ee59def855e6a8a06f0d8d8c2e61c2a301c

Download Submit
\Users\Admin\AppData\Local\Temp\259430895.txt

Filesize
102KB

MD5
f91df27697027a6b58844aa6e4fd5630

SHA1
1844dd23bd79ed8f37b6d1dabe1106e4ad72fc0c

SHA256
ae664541da4918bb5497b9efcb14b7e1182a394d58a052c60763353b49c4802e

SHA512
48beb1eebc48c5fca60dc71559d0fcbfa849e1ba9804544012ea5375a8d9d3debf6bb6d046103571b540e0747b4164111fe66dcf30f6306ce6c5f2fb968c8306

Download Submit
memory/2704-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2704-25-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2812-10-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2812-19-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads