blackmoon | a33fc45d3d24272746694f8909362b9c74bc9df19c9ce7007376433f4c750957

General

Target

e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe
Size

221KB
MD5

e80c543aab145c327b76588109aa28d1
SHA1

a35a5c8a80ab7fd7daf9df9cc653f6793cacbef9
SHA256

a33fc45d3d24272746694f8909362b9c74bc9df19c9ce7007376433f4c750957
SHA512

982aabe3302ce51752ec1903818d7097c5e056ae8ef64056f4e9f3ac1de8395d147616828baef8db98752eab348165c1fe1db24a12992ff5ff5b5b08c35e466d
SSDEEP

3072:GL0C1vc5IjJ0305245nqQMh9rfjWSEYGIBSKSwyY4fgIKFHPcoutK1vH1UFG0:iHqaqkEKGXrfqOqwyY+noSKXUL

Score

10^/10

blackmoon modiloader banker discovery trojan upx

Malware Config

Signatures

Blackmoon family
blackmoon
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral1/memory/2736-27-0x0000000000400000-0x0000000000493000-memory.dmp	family_blackmoon

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000015d90-23.dat	modiloader_stage2
behavioral1/memory/2740-29-0x0000000000400000-0x000000000042A000-memory.dmp	modiloader_stage2

Executes dropped EXE 2 IoCs

pid	Process
2736	¹Å¼£Ì½ÏÕ_.exe
2740	wyls.exe

Loads dropped DLL 6 IoCs

pid	Process
2468	e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe
2468	e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe
2468	e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe
2468	e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe
2740	wyls.exe
2736	¹Å¼£Ì½ÏÕ_.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00080000000120f6-2.dat	upx
behavioral1/memory/2468-3-0x0000000002E90000-0x0000000002F23000-memory.dmp	upx
behavioral1/memory/2736-27-0x0000000000400000-0x0000000000493000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.dll	wyls.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	¹Å¼£Ì½ÏÕ_.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2740	wyls.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2736	2468	e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe	30
PID 2468 wrote to memory of 2736	2468	e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe	30
PID 2468 wrote to memory of 2736	2468	e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe	30
PID 2468 wrote to memory of 2736	2468	e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe	30
PID 2468 wrote to memory of 2740	2468	e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe	31
PID 2468 wrote to memory of 2740	2468	e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe	31
PID 2468 wrote to memory of 2740	2468	e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe	31
PID 2468 wrote to memory of 2740	2468	e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\Temp\¹Å¼£Ì½ÏÕ_.exe
  "C:\Users\Admin\AppData\Local\Temp\¹Å¼£Ì½ÏÕ_.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2736
- C:\Users\Admin\AppData\Local\Temp\wyls.exe
  "C:\Users\Admin\AppData\Local\Temp\wyls.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wyls.exe

Filesize
29KB

MD5
99026df977ee442a43a91277469a8a4a

SHA1
c540841298a999b02e3133806a25b2c30b6f74a3

SHA256
3ea8e808930a3d01a13654a5a4fdb7fd3997b2b83f7ac79209f173311c694fa4

SHA512
c16ff15dcb9188545ce834bc76869cd36aa367b04e6bb3cd892bf49b900521b709f77b692fb54ccf941f2a6c8605aa42a2658ed247e5cf99bc1d44de3e471e0b

Download Submit
\Program Files\Common Files\Microsoft Shared\MSInfo\SysInfo.dll

Filesize
57KB

MD5
44523c6bd65372fa480a398e4ca41c8c

SHA1
3d7cf6365ef66b8f9c5304d26bc37e613b1c472b

SHA256
6cda1a8adbf76b6c5ec8af53dc7b517a788a4ca81b2bc644a98efe67cb08a616

SHA512
f0f81a9c309c0ed9f37e84f8c88f9dd80053951a47e89e24989e7d5fbc7789803ec979b12b4ea5cd4c53074aafada6dad4debdbb50036dbd5d8a3c44f2fdc6db

Download Submit
\Users\Admin\AppData\Local\Temp\¹Å¼£Ì½ÏÕ_.exe

Filesize
154KB

MD5
bf991543583d2d8664f0d958a6f3e4dd

SHA1
cf1fa4fd6f1858396e3f446fbb0f90418ecbbc79

SHA256
48a293f518c824fe4d4a29e38000de7664df3eb467db074d79d104a67693ae56

SHA512
8c2d6d8a6434d874e756859abc0a851aa6655d75b127af4932481e39d9f1d2717460f6651cc5820faf6b54a9259032abcc40dcb6788d31cd375305c4e9f19fab

Download Submit
memory/2468-3-0x0000000002E90000-0x0000000002F23000-memory.dmp

Filesize
588KB

Download
memory/2468-18-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2736-27-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2740-20-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2740-29-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing