Overview

overview

10

Static

static

3

ab19ec67d7...c3.exe

windows7-x64

10

ab19ec67d7...c3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ab19ec67d7f4c25cb3283618af92d0d41d6eadbf6559675f1de46bd453157fc3

  • Size

    10.8MB

  • Sample

    250218-fr76jaxmgx

  • MD5

    ef17bc8d2e2a62dcff54a5e52120aa11

  • SHA1

    6922ab7f37650a5a40033d21fde1e6f5bae11d4b

  • SHA256

    ab19ec67d7f4c25cb3283618af92d0d41d6eadbf6559675f1de46bd453157fc3

  • SHA512

    f88ecd9b197ec6f700aa70beed97fbc80776c5ca072dac1962c262356dc14750854432b756ca47155aef856678b464f28fc8db8481c136024d19696ecbf84b5c

  • SSDEEP

    196608:KIzjaiAU8Fiml9qwXoSqyhxHCQPvLR3/g3bWewesQs/rKd81ek:/WJFiml9qwBHpLxUWeRsQsuduZ

Score
10/10
blackmoonbankerdefense_evasiondiscoverypersistenceprivilege_escalationtrojan

Malware Config

Targets

    • Target

      ab19ec67d7f4c25cb3283618af92d0d41d6eadbf6559675f1de46bd453157fc3

    • Size

      10.8MB

    • MD5

      ef17bc8d2e2a62dcff54a5e52120aa11

    • SHA1

      6922ab7f37650a5a40033d21fde1e6f5bae11d4b

    • SHA256

      ab19ec67d7f4c25cb3283618af92d0d41d6eadbf6559675f1de46bd453157fc3

    • SHA512

      f88ecd9b197ec6f700aa70beed97fbc80776c5ca072dac1962c262356dc14750854432b756ca47155aef856678b464f28fc8db8481c136024d19696ecbf84b5c

    • SSDEEP

      196608:KIzjaiAU8Fiml9qwXoSqyhxHCQPvLR3/g3bWewesQs/rKd81ek:/WJFiml9qwBHpLxUWeRsQsuduZ

    Score
    10/10
    blackmoonbankerdefense_evasiondiscoverypersistenceprivilege_escalationtrojan

    • Blackmoon family

      blackmoon

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Adds policy Run key to start application

      persistence

    • Modifies Windows Firewall

      defense_evasion

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks