blackmoon | df0eb4e9267651c2dd6efc2f42d298c0395775b6a288a603c20f68be400224bc

Analysis

max time kernel
140s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df0eb4e9267651c2dd6efc2f42d298c0395775b6a288a603c20f68be400224bc.exe
Size

672KB
MD5

df0b63f8909bdee6ae6cdb31cbd02f2d
SHA1

13b0e1caa750d509a32248de5c48ebcc957b4b0d
SHA256

df0eb4e9267651c2dd6efc2f42d298c0395775b6a288a603c20f68be400224bc
SHA512

5ceb440ccd0f0f0ee532247e217638b98bdcf87a95d6d6ef4e21989712c88af90e77170992c9e8caeb70ce6722aed463cbc3d8f96d4960eba5478468d7300c99
SSDEEP

12288:GTRjTHe4DoEnxJsyHl087psaPWN6WZ45KSjOgfsKqBM7b/9h2nAuZNvXRqoS:GNjTHe4d7jl0cX9WZ4Q8Ogfs9Bc5UAuZ

Score

10^/10

blackmoon banker discovery trojan

Malware Config

Signatures

Blackmoon family
blackmoon
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral2/memory/4768-1-0x0000000000400000-0x0000000000565000-memory.dmp	family_blackmoon

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df0eb4e9267651c2dd6efc2f42d298c0395775b6a288a603c20f68be400224bc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4768	df0eb4e9267651c2dd6efc2f42d298c0395775b6a288a603c20f68be400224bc.exe

C:\Users\Admin\AppData\Local\Temp\df0eb4e9267651c2dd6efc2f42d298c0395775b6a288a603c20f68be400224bc.exe
"C:\Users\Admin\AppData\Local\Temp\df0eb4e9267651c2dd6efc2f42d298c0395775b6a288a603c20f68be400224bc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4768-0-0x0000000000400000-0x0000000000565000-memory.dmp

Filesize
1.4MB

Download
memory/4768-1-0x0000000000400000-0x0000000000565000-memory.dmp

Filesize
1.4MB

Download