blackmoon | d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8

General

Target

d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
Size

9.9MB
MD5

b179d566336497bab9953d3f7880339f
SHA1

28e8bef327f0de400e6396940683eb9c550a86de
SHA256

d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8
SHA512

24d47e2e1fecf76205268b3d3b1faf0f7362603f7f30588de02341a4bfa0dacf7196d7f70106cd89f611ba8a09f1cbf2bda06756f0575768a377f5c5aee514db
SSDEEP

196608:10/mSRYtxyL/iNKxGUGKkCAEHGzEK0dyB5aDb/PlxpZW:iOMYHuuKoUGKYEHmEldyB5aPfpZW

Score

10^/10

blackmoon banker discovery trojan

Malware Config

Signatures

Blackmoon family
blackmoon
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

resource	yara_rule
behavioral2/memory/3012-14-0x0000000000400000-0x00000000009FA000-memory.dmp	family_blackmoon
behavioral2/memory/2840-46-0x0000000000400000-0x00000000009FA000-memory.dmp	family_blackmoon

Executes dropped EXE 1 IoCs

pid	Process
2840	27124d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
File opened (read-only)	\??\Z:	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
File opened (read-only)	\??\K:	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
File opened (read-only)	\??\R:	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
File opened (read-only)	\??\T:	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
File opened (read-only)	\??\V:	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
File opened (read-only)	\??\S:	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
File opened (read-only)	\??\W:	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
File opened (read-only)	\??\A:	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
File opened (read-only)	\??\E:	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
File opened (read-only)	\??\G:	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
File opened (read-only)	\??\H:	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
File opened (read-only)	\??\O:	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
File opened (read-only)	\??\Y:	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
File opened (read-only)	\??\B:	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
File opened (read-only)	\??\J:	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
File opened (read-only)	\??\L:	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
File opened (read-only)	\??\N:	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
File opened (read-only)	\??\U:	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
File opened (read-only)	\??\I:	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
File opened (read-only)	\??\M:	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
File opened (read-only)	\??\P:	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
File opened (read-only)	\??\Q:	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27124d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3012	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
3012	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
3012	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
2840	27124d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
2840	27124d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
2840	27124d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2840	3012	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe	82
PID 3012 wrote to memory of 2840	3012	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe	82
PID 3012 wrote to memory of 2840	3012	d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe	82

C:\Users\Admin\AppData\Local\Temp\d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
"C:\Users\Admin\AppData\Local\Temp\d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\½£Ä§°Ë»ÄV999\27124d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
  C:\½£Ä§°Ë»ÄV999\27124d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\20549dd95b396a2ca999505047542150.txt

Filesize
16B

MD5
78f64e50c77f37cc3f9da67cb7c550ec

SHA1
6587a18e250d196019e187392f6b989591e7f0be

SHA256
c87c8179a8640232b300fb605b9570cbeb631ae2778525abad72bce4a9bb7e27

SHA512
0c82ca36862f95bc42a8f214c3ae4caf54073cea4f6903003e93c73671d6321435ea3ab9a12f07da03d20edb4a7abf62e74d158d5e43ca0abab9be856fd8056b

Download Submit
C:\½£Ä§°Ë»ÄV999\27124d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8.exe

Filesize
9.9MB

MD5
b179d566336497bab9953d3f7880339f

SHA1
28e8bef327f0de400e6396940683eb9c550a86de

SHA256
d7bd2ba3de80a8c457c9c58bf837f6f389c8b8e8e67b6050c3e5bcb0700b80a8

SHA512
24d47e2e1fecf76205268b3d3b1faf0f7362603f7f30588de02341a4bfa0dacf7196d7f70106cd89f611ba8a09f1cbf2bda06756f0575768a377f5c5aee514db

Download Submit
memory/2840-17-0x0000000000A50000-0x0000000000A53000-memory.dmp

Filesize
12KB

Download
memory/2840-46-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/2840-47-0x0000000000A50000-0x0000000000A53000-memory.dmp

Filesize
12KB

Download
memory/2840-15-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/3012-16-0x0000000000FB0000-0x0000000000FB3000-memory.dmp

Filesize
12KB

Download
memory/3012-0-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/3012-5-0x00000000040B0000-0x00000000040B1000-memory.dmp

Filesize
4KB

Download
memory/3012-14-0x0000000000400000-0x00000000009FA000-memory.dmp

Filesize
6.0MB

Download
memory/3012-6-0x0000000003F50000-0x0000000003F51000-memory.dmp

Filesize
4KB

Download
memory/3012-7-0x00000000040C0000-0x00000000040C1000-memory.dmp

Filesize
4KB

Download
memory/3012-1-0x0000000000FB0000-0x0000000000FB3000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing