blackmoon | a33fc45d3d24272746694f8909362b9c74bc9df19c9ce7007376433f4c750957

Analysis

max time kernel
140s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/12/2024, 20:03 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe
Size

221KB
MD5

e80c543aab145c327b76588109aa28d1
SHA1

a35a5c8a80ab7fd7daf9df9cc653f6793cacbef9
SHA256

a33fc45d3d24272746694f8909362b9c74bc9df19c9ce7007376433f4c750957
SHA512

982aabe3302ce51752ec1903818d7097c5e056ae8ef64056f4e9f3ac1de8395d147616828baef8db98752eab348165c1fe1db24a12992ff5ff5b5b08c35e466d
SSDEEP

3072:GL0C1vc5IjJ0305245nqQMh9rfjWSEYGIBSKSwyY4fgIKFHPcoutK1vH1UFG0:iHqaqkEKGXrfqOqwyY+noSKXUL

Score

10^/10

blackmoon modiloader banker discovery trojan upx

Malware Config

Signatures

Blackmoon family
blackmoon
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral2/memory/1800-33-0x0000000000400000-0x0000000000493000-memory.dmp	family_blackmoon

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 9 IoCs

resource	yara_rule
behavioral2/memory/3236-20-0x0000000000400000-0x000000000042A000-memory.dmp	modiloader_stage2
behavioral2/files/0x0007000000023c9f-25.dat	modiloader_stage2
behavioral2/memory/3236-26-0x0000000001F00000-0x0000000001F13000-memory.dmp	modiloader_stage2
behavioral2/memory/1800-32-0x0000000002490000-0x00000000024A3000-memory.dmp	modiloader_stage2
behavioral2/memory/1800-35-0x0000000002490000-0x00000000024A3000-memory.dmp	modiloader_stage2
behavioral2/memory/3236-37-0x0000000000400000-0x000000000042A000-memory.dmp	modiloader_stage2
behavioral2/memory/3236-36-0x0000000001F00000-0x0000000001F13000-memory.dmp	modiloader_stage2
behavioral2/memory/1800-42-0x0000000002490000-0x00000000024A3000-memory.dmp	modiloader_stage2
behavioral2/memory/3236-70-0x0000000001F00000-0x0000000001F13000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
1800	¹Å¼£Ì½ÏÕ_.exe
3236	wyls.exe

Loads dropped DLL 4 IoCs

pid	Process
3236	wyls.exe
3236	wyls.exe
1800	¹Å¼£Ì½ÏÕ_.exe
1800	¹Å¼£Ì½ÏÕ_.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000a000000023c05-4.dat	upx
behavioral2/memory/1800-11-0x0000000000400000-0x0000000000493000-memory.dmp	upx
behavioral2/memory/1800-33-0x0000000000400000-0x0000000000493000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.dll	wyls.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	¹Å¼£Ì½ÏÕ_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wyls.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3236	wyls.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 1800	1176	e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe	82
PID 1176 wrote to memory of 1800	1176	e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe	82
PID 1176 wrote to memory of 1800	1176	e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe	82
PID 1176 wrote to memory of 3236	1176	e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe	83
PID 1176 wrote to memory of 3236	1176	e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe	83
PID 1176 wrote to memory of 3236	1176	e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e80c543aab145c327b76588109aa28d1_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Users\Admin\AppData\Local\Temp\¹Å¼£Ì½ÏÕ_.exe
  "C:\Users\Admin\AppData\Local\Temp\¹Å¼£Ì½ÏÕ_.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1800
- C:\Users\Admin\AppData\Local\Temp\wyls.exe
  "C:\Users\Admin\AppData\Local\Temp\wyls.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3236

Network

DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR

Response

8.8.8.8.in-addr.arpa

IN PTR

dnsgoogle
DNS

154.239.44.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

154.239.44.20.in-addr.arpa

IN PTR

Response
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

23.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

23.159.190.20.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

97.17.167.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

97.17.167.52.in-addr.arpa

IN PTR

Response
DNS

133.211.185.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

133.211.185.52.in-addr.arpa

IN PTR

Response
DNS

197.87.175.4.in-addr.arpa

Remote address:

8.8.8.8:53

Request

197.87.175.4.in-addr.arpa

IN PTR

Response
DNS

206.23.85.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.23.85.13.in-addr.arpa

IN PTR

Response
DNS

138.121.18.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

138.121.18.2.in-addr.arpa

IN PTR

Response

138.121.18.2.in-addr.arpa

IN PTR

a2-18-121-138deploystaticakamaitechnologiescom
DNS

22.49.80.91.in-addr.arpa

Remote address:

8.8.8.8:53

Request

22.49.80.91.in-addr.arpa

IN PTR

Response
DNS

181.129.81.91.in-addr.arpa

Remote address:

8.8.8.8:53

Request

181.129.81.91.in-addr.arpa

IN PTR

Response
DNS

19.229.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

19.229.111.52.in-addr.arpa

IN PTR

Response

No results found

8.8.8.8:53

8.8.8.8.in-addr.arpa

dns

66 B
90 B
1
1

DNS Request

8.8.8.8.in-addr.arpa
8.8.8.8:53

154.239.44.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

154.239.44.20.in-addr.arpa
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa
8.8.8.8:53

23.159.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

23.159.190.20.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

97.17.167.52.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

97.17.167.52.in-addr.arpa
8.8.8.8:53

133.211.185.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

133.211.185.52.in-addr.arpa
8.8.8.8:53

197.87.175.4.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

197.87.175.4.in-addr.arpa
8.8.8.8:53

206.23.85.13.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

206.23.85.13.in-addr.arpa
8.8.8.8:53

138.121.18.2.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

138.121.18.2.in-addr.arpa
8.8.8.8:53

22.49.80.91.in-addr.arpa

dns

70 B
145 B
1
1

DNS Request

22.49.80.91.in-addr.arpa
8.8.8.8:53

181.129.81.91.in-addr.arpa

dns

72 B
147 B
1
1

DNS Request

181.129.81.91.in-addr.arpa
8.8.8.8:53

19.229.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

19.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\MSInfo\SysInfo.dll

Filesize
57KB

MD5
44523c6bd65372fa480a398e4ca41c8c

SHA1
3d7cf6365ef66b8f9c5304d26bc37e613b1c472b

SHA256
6cda1a8adbf76b6c5ec8af53dc7b517a788a4ca81b2bc644a98efe67cb08a616

SHA512
f0f81a9c309c0ed9f37e84f8c88f9dd80053951a47e89e24989e7d5fbc7789803ec979b12b4ea5cd4c53074aafada6dad4debdbb50036dbd5d8a3c44f2fdc6db

Download Submit
C:\Users\Admin\AppData\Local\Temp\wyls.exe

Filesize
29KB

MD5
99026df977ee442a43a91277469a8a4a

SHA1
c540841298a999b02e3133806a25b2c30b6f74a3

SHA256
3ea8e808930a3d01a13654a5a4fdb7fd3997b2b83f7ac79209f173311c694fa4

SHA512
c16ff15dcb9188545ce834bc76869cd36aa367b04e6bb3cd892bf49b900521b709f77b692fb54ccf941f2a6c8605aa42a2658ed247e5cf99bc1d44de3e471e0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\¹Å¼£Ì½ÏÕ_.exe

Filesize
154KB

MD5
bf991543583d2d8664f0d958a6f3e4dd

SHA1
cf1fa4fd6f1858396e3f446fbb0f90418ecbbc79

SHA256
48a293f518c824fe4d4a29e38000de7664df3eb467db074d79d104a67693ae56

SHA512
8c2d6d8a6434d874e756859abc0a851aa6655d75b127af4932481e39d9f1d2717460f6651cc5820faf6b54a9259032abcc40dcb6788d31cd375305c4e9f19fab

Download Submit
memory/1176-21-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1800-35-0x0000000002490000-0x00000000024A3000-memory.dmp

Filesize
76KB

Download
memory/1800-11-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1800-42-0x0000000002490000-0x00000000024A3000-memory.dmp

Filesize
76KB

Download
memory/1800-32-0x0000000002490000-0x00000000024A3000-memory.dmp

Filesize
76KB

Download
memory/1800-33-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/3236-20-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3236-37-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3236-36-0x0000000001F00000-0x0000000001F13000-memory.dmp

Filesize
76KB

Download
memory/3236-26-0x0000000001F00000-0x0000000001F13000-memory.dmp

Filesize
76KB

Download
memory/3236-70-0x0000000001F00000-0x0000000001F13000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.