blackmoon | d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0

Analysis

max time kernel
141s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
Size

107KB
MD5

e919228dc7dad297ff3b11ba33e6bf63
SHA1

ae82ec491c80521d8d74bc11d26d3dfe103e8c3f
SHA256

d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0
SHA512

d712412c63a808ac6623d8988fac4a29f6fc87b1bd0ae784494654146847dc2a6fd6b57907f2f798c6de42698c1304e65b2fe836a294d74435c0732dbe89dcce
SSDEEP

1536:nnTCqOpUwDWHpuFFedUSERPfZnmQJYR3iVeO64MDYewM6CbEjZV5MRigHR3S20Z8:TwUw88FeMVmgYR3VO64MEew9rHml3Y

Score

10^/10

blackmoon fatalrat banker discovery infostealer rat trojan vmprotect

Malware Config

Signatures

Blackmoon family
blackmoon
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 5 IoCs

resource	yara_rule
behavioral1/memory/2212-3-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackmoon
behavioral1/memory/2212-5-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackmoon
behavioral1/memory/2212-25-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackmoon
behavioral1/memory/2212-56-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackmoon
behavioral1/memory/2212-75-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackmoon

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
infostealer rat fatalrat
Fatalrat family
fatalrat

Fatal Rat payload 1 IoCs

rat infostealer

resource	yara_rule
behavioral1/memory/2004-67-0x0000000010000000-0x000000001002D000-memory.dmp	fatalrat

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
848	spower.exe
544	upssvc.exe
2004	svchost.exe

Loads dropped DLL 5 IoCs

pid	Process
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x0005000000019501-33.dat	vmprotect
behavioral1/memory/848-40-0x000000013FDD0000-0x0000000140007000-memory.dmp	vmprotect
behavioral1/memory/848-50-0x000000013FDD0000-0x0000000140007000-memory.dmp	vmprotect
behavioral1/memory/848-46-0x000000013FDD0000-0x0000000140007000-memory.dmp	vmprotect
behavioral1/memory/2212-38-0x0000000003A00000-0x0000000003C37000-memory.dmp	vmprotect

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\360\360Safe\safemon\360tray.exe	upssvc.exe
File opened for modification	C:\Program Files (x86)\360\360sd\360sd.exe	upssvc.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SCHTASKS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SCHTASKS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
488	SCHTASKS.exe
2656	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
544	upssvc.exe
544	upssvc.exe
544	upssvc.exe
544	upssvc.exe
544	upssvc.exe
544	upssvc.exe
544	upssvc.exe
544	upssvc.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 488	2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe	31
PID 2212 wrote to memory of 488	2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe	31
PID 2212 wrote to memory of 488	2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe	31
PID 2212 wrote to memory of 488	2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe	31
PID 2212 wrote to memory of 848	2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe	34
PID 2212 wrote to memory of 848	2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe	34
PID 2212 wrote to memory of 848	2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe	34
PID 2212 wrote to memory of 848	2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe	34
PID 2212 wrote to memory of 544	2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe	35
PID 2212 wrote to memory of 544	2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe	35
PID 2212 wrote to memory of 544	2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe	35
PID 2212 wrote to memory of 544	2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe	35
PID 2212 wrote to memory of 2004	2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe	37
PID 2212 wrote to memory of 2004	2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe	37
PID 2212 wrote to memory of 2004	2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe	37
PID 2212 wrote to memory of 2004	2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe	37
PID 2212 wrote to memory of 2656	2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe	38
PID 2212 wrote to memory of 2656	2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe	38
PID 2212 wrote to memory of 2656	2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe	38
PID 2212 wrote to memory of 2656	2212	d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe	38

C:\Users\Admin\AppData\Local\Temp\d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe
"C:\Users\Admin\AppData\Local\Temp\d36d96120d39714d34f6f2117bfc9d1ffa909fc39b343c7654e9267b692bbae0.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\SCHTASKS.exe
  SCHTASKS /Create /SC ONLOGON /TN WindowsUpdata /F /RL HIGHEST /TR C:\Users\Public\Picturesweq072b2\CCCef3Render.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:488
- C:\Users\Admin\AppData\Local\Temp\weq072b2ojgjmvz\spower.exe
  C:\Users\Admin\AppData\Local\Temp\weq072b2ojgjmvz\spower.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Users\Admin\AppData\Local\Temp\weq072b2ojgjmvz\upssvc.exe
  C:\Users\Admin\AppData\Local\Temp\weq072b2ojgjmvz\upssvc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:544
- C:\ProgramData\NVIDIARV\svchost.exe
  C:\ProgramData\NVIDIARV\svchost.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2004
- C:\Windows\SysWOW64\SCHTASKS.exe
  SCHTASKS /Create /SC ONLOGON /TN WindowsUpdata /F /RL HIGHEST /TR C:\Users\Public\Picturesweq072b2\CCCef3Render.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\weq072b2ojgjmvz\upssvc.exe

Filesize
149KB

MD5
864489e91cfa1bc4cb7ce23b3d923d44

SHA1
438c0ac69bd93d110bc0a8d1516593c2eb65f473

SHA256
89f90dfe08c97c4a397a715cee4e49f0892ff3f3b42e34d48837cadf766f7d4f

SHA512
358e0f49569b41687accbde8d67e899fcfe3d34c5a17107dc132a5706e47bcb6ea41e900d30a5b2b45aa792ddaf089c507f6e3c3d235a4bde997c31165f4227d

Download Submit
\ProgramData\NVIDIARV\svchost.exe

Filesize
3.4MB

MD5
94ed4dfe17ddc0b571873aca8323d455

SHA1
068cbdc24be00d84e9f271369fbb95a7d53583e0

SHA256
d57b68baeb9c6a55b11fb5670f2b0b02caecf6b613abc294bfbb90ba5594cde7

SHA512
0906893bb018144129e67ac7239ca0d566e3df6346beeef8433d94e37b4f13869bce231a7b6726690c4ba6f398542965804e5eac074fe7a9d50fdef28bd098f4

Download Submit
\Users\Admin\AppData\Local\Temp\weq072b2ojgjmvz\spower.exe

Filesize
1.1MB

MD5
f89e772299c153a4b8d8e7b1fa299264

SHA1
e48c541024e6a0858a4b31fc823181ef17c3d935

SHA256
2e32a47e57813d56dffd76582e3a99bcbc697990b5e257f6171a818ac6327841

SHA512
058c75f843742beca4ea8546005466dfdb0f50c6eb7cf0da721d90883534b331bae9629f75e33cd9956ad0829c05bb219e2eba8876bd89056ef99c7053095e35

Download Submit
memory/544-54-0x000000013F230000-0x000000013F27A000-memory.dmp

Filesize
296KB

Download
memory/544-49-0x000000013F230000-0x000000013F27A000-memory.dmp

Filesize
296KB

Download
memory/544-53-0x000000013F230000-0x000000013F27A000-memory.dmp

Filesize
296KB

Download
memory/848-46-0x000000013FDD0000-0x0000000140007000-memory.dmp

Filesize
2.2MB

Download
memory/848-40-0x000000013FDD0000-0x0000000140007000-memory.dmp

Filesize
2.2MB

Download
memory/848-50-0x000000013FDD0000-0x0000000140007000-memory.dmp

Filesize
2.2MB

Download
memory/2004-67-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download
memory/2004-64-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/2212-39-0x00000000037E0000-0x000000000382A000-memory.dmp

Filesize
296KB

Download
memory/2212-38-0x0000000003A00000-0x0000000003C37000-memory.dmp

Filesize
2.2MB

Download
memory/2212-48-0x00000000037E0000-0x000000000382A000-memory.dmp

Filesize
296KB

Download
memory/2212-0-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2212-55-0x0000000003A00000-0x0000000003C37000-memory.dmp

Filesize
2.2MB

Download
memory/2212-56-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2212-25-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2212-5-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2212-3-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2212-75-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download