Malware Analysis Report

2025-08-05 10:38

Sample ID 241018-x5y88athmc
Target 749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca
SHA256 749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca
Tags
blackmoon banker discovery trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca

Threat Level: Known bad

The file 749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca was found to be: Known bad.

Malicious Activity Summary

blackmoon banker discovery trojan upx

Blackmoon, KrBanker

Detect Blackmoon payload

Blackmoon family

Deletes itself

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

UPX packed file

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-18 19:26

Signatures

Blackmoon family

blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-18 19:26

Reported

2024-10-18 19:27

Platform

win7-20240903-en

Max time kernel

59s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe

"C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe"

C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe

"C:\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 i2.tietuku.com udp

Files

memory/2848-0-0x0000000000400000-0x000000000046E000-memory.dmp

memory/2848-7-0x0000000000400000-0x000000000046E000-memory.dmp

\Users\Admin\AppData\Local\Temp\Syslemkchgb.exe

MD5 3dae46c6c17dcf650b7c5353a81ef31e
SHA1 1f93b5c83fa49e6bd08b49dff28e2c841499c932
SHA256 2440ad23231ac4720700db07cb98f13b34d8a67b863348adc3d27ec9862b29b5
SHA512 333f90ae2fdbd8b30120747540ca8d82368f95a9b4e74eb6016d74851d040b8942e2f4fca10f405be888a7bd0038c65a75ce842b95e93c0092a5d09534c0d7fe

memory/2596-18-0x0000000000400000-0x000000000046E000-memory.dmp

memory/2848-17-0x0000000003160000-0x00000000031CE000-memory.dmp

memory/2848-11-0x0000000003160000-0x00000000031CE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\lpath.ini

MD5 fb8abda925a7cb9a18da9e549724471d
SHA1 0c21ff317ab37de37e6b1a395e2a84700cf57ba0
SHA256 cbba1a97f432a53f3618722a406b77fba78e4f5c61a0d07145e894043a2a0cc0
SHA512 b230ef8fb52fc6eca54b1319df6a8344deb4dcfa23b645dc99deca9ed71976996951bb7b3a2cb6f92293cbb09e36c47ce1954a0bfbd0552539778b1e1950b3ec

memory/2596-22-0x0000000000400000-0x000000000046E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-18 19:26

Reported

2024-10-18 19:27

Platform

win10v2004-20241007-en

Max time kernel

59s

Max time network

39s

Command Line

"C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe

"C:\Users\Admin\AppData\Local\Temp\749d7db3ebc03a0ba180b5f52f57d8d9ff749fabde17ad9e63580b3ec591e6ca.exe"

C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe

"C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 i2.tietuku.com udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 103.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 110.11.19.2.in-addr.arpa udp

Files

memory/904-0-0x0000000000400000-0x000000000046E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Syslemaexwd.exe

MD5 ba1f82f91f1ae28cf5888ac1d0880916
SHA1 8d0762bbca8f61ff8f70849ef25dc0465837e224
SHA256 43f3d8ccef6096a9f6b74b507ac0d4ead58dc8754a0628da48fd3d9a92320756
SHA512 d137f073ad1761e5f9e2aca2ad919e5db145ef31e884ee3f3504bb8960a2ca4944cbbc33869f7b6960ed4d448cc406039d715d78923e8cc823e265a0b41abb8e

memory/904-14-0x0000000000400000-0x000000000046E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\lpath.ini

MD5 fb8abda925a7cb9a18da9e549724471d
SHA1 0c21ff317ab37de37e6b1a395e2a84700cf57ba0
SHA256 cbba1a97f432a53f3618722a406b77fba78e4f5c61a0d07145e894043a2a0cc0
SHA512 b230ef8fb52fc6eca54b1319df6a8344deb4dcfa23b645dc99deca9ed71976996951bb7b3a2cb6f92293cbb09e36c47ce1954a0bfbd0552539778b1e1950b3ec

memory/1436-16-0x0000000000400000-0x000000000046E000-memory.dmp