blackmoon | 9a3be43c67a761eef2460d1cf3a66d2467be931d2dcb3d5af37a00c86d15478d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 11:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a3be43c67a761eef2460d1cf3a66d2467be931d2dcb3d5af37a00c86d15478d.exe
Size

669KB
MD5

a26138a0726de2fc0eda14eaaaebeaba
SHA1

2771aaea49b67cadbbaf73739a05895d169fa383
SHA256

9a3be43c67a761eef2460d1cf3a66d2467be931d2dcb3d5af37a00c86d15478d
SHA512

3c7f4ac398294c860d0695f7e3c1792f8e781126e89b132dff9b312f284554789083574f1ae79e455bca8d97d60df4a9fb42dbc3c7666b60e135ad59c243a0cd
SSDEEP

12288:GnE+9r9Ppb12aBFBZtt3Z5PoxZimwr4f9IpdOUVxfDthqQkY5ygrI3gVAiujoS:GnEG3vB95yJgqBKbtEQBJI3gVAi

Score

10^/10

blackmoon banker discovery trojan

Malware Config

Signatures

Blackmoon family
blackmoon
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1884-1-0x0000000000400000-0x00000000006C7000-memory.dmp	family_blackmoon

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

9a3be43c67a761eef2460d1cf3a66d2467be931d2dcb3d5af37a00c86d15478d.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9a3be43c67a761eef2460d1cf3a66d2467be931d2dcb3d5af37a00c86d15478d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

9a3be43c67a761eef2460d1cf3a66d2467be931d2dcb3d5af37a00c86d15478d.exe

pid process

1884 9a3be43c67a761eef2460d1cf3a66d2467be931d2dcb3d5af37a00c86d15478d.exe

pid	process
1884	9a3be43c67a761eef2460d1cf3a66d2467be931d2dcb3d5af37a00c86d15478d.exe

C:\Users\Admin\AppData\Local\Temp\9a3be43c67a761eef2460d1cf3a66d2467be931d2dcb3d5af37a00c86d15478d.exe
"C:\Users\Admin\AppData\Local\Temp\9a3be43c67a761eef2460d1cf3a66d2467be931d2dcb3d5af37a00c86d15478d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1884-0-0x0000000000400000-0x00000000006C7000-memory.dmp

Filesize
2.8MB

Download
memory/1884-1-0x0000000000400000-0x00000000006C7000-memory.dmp

Filesize
2.8MB

Download