blackmoon | 05dcf10fca338b6872a52afb4935928fcc2575610f7e1f65ed3eb76b911e74c9

General

Target

05dcf10fca338b6872a52afb4935928fcc2575610f7e1f65ed3eb76b911e74c9.exe
Size

10.2MB
MD5

b79e05b90f69462bedd16ee5316f1efe
SHA1

724b5ef7823ad25d0a8fbb41fde972571fdc268a
SHA256

05dcf10fca338b6872a52afb4935928fcc2575610f7e1f65ed3eb76b911e74c9
SHA512

f54606c7a54afff00bf32824411cb5ae39ebd83d1498127d3601b8b333ee9bb6970e08c40e6d743caee1775ee866d4226ef7191829dfdc6c54309e8dffd0e47a
SSDEEP

98304:qvk38YyRM1xg3DEP1Y+OsUoD6NTxT5u3qLGhnjDKscdft6hrsP+76L49v2cLObHO:P8YyO1xg3a7VD6Nfkcdft6psPRL49/

Score

10^/10

blackmoon banker discovery persistence trojan

Malware Config

Signatures

Blackmoon family
blackmoon
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023b8b-14.dat	family_blackmoon

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	jFy4HZ7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jFy4HZ7 = "C:\\Users\\Admin\\AppData\\Roaming\\winods\\87lP5JVsc_nHWDVZ\\jFy4HZ7.exe"	jFy4HZ7.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	05dcf10fca338b6872a52afb4935928fcc2575610f7e1f65ed3eb76b911e74c9.exe

Executes dropped EXE 1 IoCs

pid	Process
1648	jFy4HZ7.exe

Loads dropped DLL 1 IoCs

pid	Process
1648	jFy4HZ7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	05dcf10fca338b6872a52afb4935928fcc2575610f7e1f65ed3eb76b911e74c9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	05dcf10fca338b6872a52afb4935928fcc2575610f7e1f65ed3eb76b911e74c9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jFy4HZ7.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1648	jFy4HZ7.exe
1648	jFy4HZ7.exe
1648	jFy4HZ7.exe
1648	jFy4HZ7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1648	jFy4HZ7.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4580	05dcf10fca338b6872a52afb4935928fcc2575610f7e1f65ed3eb76b911e74c9.exe
4796	05dcf10fca338b6872a52afb4935928fcc2575610f7e1f65ed3eb76b911e74c9.exe
1648	jFy4HZ7.exe
1648	jFy4HZ7.exe
1648	jFy4HZ7.exe
1648	jFy4HZ7.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 4796	4580	05dcf10fca338b6872a52afb4935928fcc2575610f7e1f65ed3eb76b911e74c9.exe	83
PID 4580 wrote to memory of 4796	4580	05dcf10fca338b6872a52afb4935928fcc2575610f7e1f65ed3eb76b911e74c9.exe	83
PID 4580 wrote to memory of 4796	4580	05dcf10fca338b6872a52afb4935928fcc2575610f7e1f65ed3eb76b911e74c9.exe	83
PID 4796 wrote to memory of 1648	4796	05dcf10fca338b6872a52afb4935928fcc2575610f7e1f65ed3eb76b911e74c9.exe	98
PID 4796 wrote to memory of 1648	4796	05dcf10fca338b6872a52afb4935928fcc2575610f7e1f65ed3eb76b911e74c9.exe	98
PID 4796 wrote to memory of 1648	4796	05dcf10fca338b6872a52afb4935928fcc2575610f7e1f65ed3eb76b911e74c9.exe	98

C:\Users\Admin\AppData\Local\Temp\05dcf10fca338b6872a52afb4935928fcc2575610f7e1f65ed3eb76b911e74c9.exe
"C:\Users\Admin\AppData\Local\Temp\05dcf10fca338b6872a52afb4935928fcc2575610f7e1f65ed3eb76b911e74c9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Users\Admin\AppData\Local\Temp\05dcf10fca338b6872a52afb4935928fcc2575610f7e1f65ed3eb76b911e74c9.exe
  C:\Users\Admin\AppData\Local\Temp\05dcf10fca338b6872a52afb4935928fcc2575610f7e1f65ed3eb76b911e74c9.exe 400339035F03560370036603710370035F03420367036E036A036D035F0342037303730347036203770362035F0351036C0362036E036A036D0364035F0374036A036D036C03670370035F033B0334036F035303360349035503700360035C036D034B0354034703550359035F03690345037A0337034B0359033403--aa`
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Users\Admin\AppData\Roaming\winods\87lP5JVsc_nHWDVZ\jFy4HZ7.exe
    "C:\Users\Admin\AppData\Roaming\winods\87lP5JVsc_nHWDVZ\jFy4HZ7.exe"
    3⤵
    - Adds policy Run key to start application
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\winods\87lP5JVsc_nHWDVZ\D3D11InstallHelper.dll

Filesize
2.1MB

MD5
8740ce1d9b7a8236c7145eb291fb7b06

SHA1
4d31f310f7d3c24aca4512633560ab58c34fb68b

SHA256
a70c87b85e268dfb6c316124f7cb95a782d9a6f891a02de63b040c8ad28e3ecc

SHA512
fcbec598448c135c2caef92671cde51df486830df00cad60c9c8907d321a6b65b74acdf80e7914a4148b17c1ed4d44940b2f56e4de1f27ffc3276a336a526470

Download Submit
C:\Users\Admin\AppData\Roaming\winods\87lP5JVsc_nHWDVZ\jFy4HZ7.exe

Filesize
198KB

MD5
1f9d473236876e3304f82b145db5a7f1

SHA1
d47a2f46a1997b789aa5e78683432a1b2e883353

SHA256
6f9ba12ec828d1f64776e598345c9e0217de410a23e29be909721397764d5bbe

SHA512
72bfa351818fa6cabd99b666bcf3a3a5ec1705b6c4cb9a80f64d37aee6694dadd08b1d28f40280436bfd1db42a5ffeeeec8834dd6d976ed320e9cdef88f36a10

Download Submit
C:\Users\Admin\AppData\Roaming\winods\87lP5JVsc_nHWDVZ\jFy4HZ7.txt

Filesize
369B

MD5
6e7c0de57fb453aef654e025c24d34bc

SHA1
5d0549a5ab1ab4ade57f3c6f024b786f68935a2c

SHA256
5d7e6771522f5b9c3a8aa7a425425dfe2e437924daca9ffaeff932fce1742b67

SHA512
fac734304d61edeb3f4dbb09c34c034e1532f7d24b18d265026bbb71ce675e80ebebbcb22df6ba6bd688fac64ca00f02b21baa5c9aba917d7aaac2944b56de7d

Download Submit
memory/1648-17-0x0000000000D00000-0x0000000000D01000-memory.dmp

Filesize
4KB

Download
memory/1648-26-0x0000000003D60000-0x0000000003E4B000-memory.dmp

Filesize
940KB

Download
memory/1648-18-0x00000000025E0000-0x00000000026C7000-memory.dmp

Filesize
924KB

Download
memory/1648-19-0x00000000025E0000-0x00000000026C7000-memory.dmp

Filesize
924KB

Download
memory/1648-21-0x00000000025E0000-0x00000000026C7000-memory.dmp

Filesize
924KB

Download
memory/1648-15-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

Filesize
4KB

Download
memory/1648-22-0x0000000003710000-0x0000000003921000-memory.dmp

Filesize
2.1MB

Download
memory/1648-16-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/1648-28-0x0000000004400000-0x0000000004575000-memory.dmp

Filesize
1.5MB

Download
memory/1648-30-0x0000000003970000-0x0000000003971000-memory.dmp

Filesize
4KB

Download
memory/1648-31-0x0000000003710000-0x0000000003921000-memory.dmp

Filesize
2.1MB

Download
memory/1648-32-0x00000000042B0000-0x0000000004302000-memory.dmp

Filesize
328KB

Download
memory/1648-33-0x00000000025E0000-0x00000000026C7000-memory.dmp

Filesize
924KB

Download
memory/1648-34-0x0000000003710000-0x0000000003921000-memory.dmp

Filesize
2.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads