Overview

overview

10

Static

static

3

3383dcb4e2...4d.exe

windows7-x64

10

3383dcb4e2...4d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3383dcb4e24256d7277476240fcd4c0ddab068354a593b7fa44e34747bc7ba4d

  • Size

    8.5MB

  • Sample

    250218-fnckfsxnbp

  • MD5

    2456624627e25858a55bdb10ac4381b1

  • SHA1

    5df9d74ad18539339fc07d66b402a8df44f7e56a

  • SHA256

    3383dcb4e24256d7277476240fcd4c0ddab068354a593b7fa44e34747bc7ba4d

  • SHA512

    5acc9bc8dcf2d5cd61453529485da91a15ce755904ac22733efa3d11dac3ab74f1422d3a221d972866b08ddd88e39cb7ee6432e0b5d7ce2135096523864c2043

  • SSDEEP

    196608:u709N4/sdRcT/thkgEjn0bxB/OyAr9UPz3kjmzqd:b9N4/sdRcTlzP+03Q

Score
10/10
blackmoonbankerdefense_evasiondiscoverypersistenceprivilege_escalationtrojan

Malware Config

Targets

    • Target

      3383dcb4e24256d7277476240fcd4c0ddab068354a593b7fa44e34747bc7ba4d

    • Size

      8.5MB

    • MD5

      2456624627e25858a55bdb10ac4381b1

    • SHA1

      5df9d74ad18539339fc07d66b402a8df44f7e56a

    • SHA256

      3383dcb4e24256d7277476240fcd4c0ddab068354a593b7fa44e34747bc7ba4d

    • SHA512

      5acc9bc8dcf2d5cd61453529485da91a15ce755904ac22733efa3d11dac3ab74f1422d3a221d972866b08ddd88e39cb7ee6432e0b5d7ce2135096523864c2043

    • SSDEEP

      196608:u709N4/sdRcT/thkgEjn0bxB/OyAr9UPz3kjmzqd:b9N4/sdRcTlzP+03Q

    Score
    10/10
    blackmoonbankerdefense_evasiondiscoverypersistenceprivilege_escalationtrojan

    • Blackmoon family

      blackmoon

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Adds policy Run key to start application

      persistence

    • Modifies Windows Firewall

      defense_evasion

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks