blackmoon | 1b8c6bc00cc39b9a2e33b30dde7d47e4eb403f23b376647124a60e14eb9b5dde

Analysis

max time kernel
300s
max time network
132s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/03/2025, 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b8c6bc00cc39b9a2e33b30dde7d47e4eb403f23b376647124a60e14eb9b5dde.exe
Size

452KB
MD5

2701db0e63f3b1c481c8f194eab8875f
SHA1

c5d9e9329859076453036dacffc8575a03a2582e
SHA256

1b8c6bc00cc39b9a2e33b30dde7d47e4eb403f23b376647124a60e14eb9b5dde
SHA512

cf93240e31c88b934dc936d59f43ad1b7b04751d2fb292b2d6c77ff481e018921d3e9a5f526da0c81d39ddd52914a5d9e72b6eb2689f4ddf57d936db935a212a
SSDEEP

6144:/vPBvEQR6H3Udg2FuHRfepwqHpA7b2+yO2COKCZv:/vpv/R6H3U25fehHpAW+yOBOKCZv

Score

10^/10

blackmoon qqpass banker discovery trojan upx

Malware Config

Extracted

Family

qqpass

Attributes

user_agent
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Signatures

Blackmoon family
blackmoon
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 5 IoCs

resource	yara_rule
behavioral1/memory/764-0-0x0000000000400000-0x0000000000473000-memory.dmp	family_blackmoon
behavioral1/memory/764-11-0x0000000000400000-0x0000000000473000-memory.dmp	family_blackmoon
behavioral1/files/0x0006000000019458-16.dat	family_blackmoon
behavioral1/memory/2600-22-0x0000000000400000-0x0000000000473000-memory.dmp	family_blackmoon
behavioral1/memory/2600-146-0x0000000000400000-0x0000000000473000-memory.dmp	family_blackmoon

QQpass
QQpass is a trojan written in C++..
trojan qqpass
Qqpass family
qqpass

Executes dropped EXE 1 IoCs

pid	Process
2600	elxplorerehzpb.exe

Loads dropped DLL 2 IoCs

pid	Process
764	1b8c6bc00cc39b9a2e33b30dde7d47e4eb403f23b376647124a60e14eb9b5dde.exe
764	1b8c6bc00cc39b9a2e33b30dde7d47e4eb403f23b376647124a60e14eb9b5dde.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/764-0-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/764-11-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/files/0x0006000000019458-16.dat	upx
behavioral1/memory/2600-22-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/2600-146-0x0000000000400000-0x0000000000473000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1b8c6bc00cc39b9a2e33b30dde7d47e4eb403f23b376647124a60e14eb9b5dde.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	elxplorerehzpb.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
764	1b8c6bc00cc39b9a2e33b30dde7d47e4eb403f23b376647124a60e14eb9b5dde.exe
764	1b8c6bc00cc39b9a2e33b30dde7d47e4eb403f23b376647124a60e14eb9b5dde.exe
764	1b8c6bc00cc39b9a2e33b30dde7d47e4eb403f23b376647124a60e14eb9b5dde.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe
2600	elxplorerehzpb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 2600	764	1b8c6bc00cc39b9a2e33b30dde7d47e4eb403f23b376647124a60e14eb9b5dde.exe	32
PID 764 wrote to memory of 2600	764	1b8c6bc00cc39b9a2e33b30dde7d47e4eb403f23b376647124a60e14eb9b5dde.exe	32
PID 764 wrote to memory of 2600	764	1b8c6bc00cc39b9a2e33b30dde7d47e4eb403f23b376647124a60e14eb9b5dde.exe	32
PID 764 wrote to memory of 2600	764	1b8c6bc00cc39b9a2e33b30dde7d47e4eb403f23b376647124a60e14eb9b5dde.exe	32

C:\Users\Admin\AppData\Local\Temp\1b8c6bc00cc39b9a2e33b30dde7d47e4eb403f23b376647124a60e14eb9b5dde.exe
"C:\Users\Admin\AppData\Local\Temp\1b8c6bc00cc39b9a2e33b30dde7d47e4eb403f23b376647124a60e14eb9b5dde.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:764
- C:\Users\Admin\AppData\Local\Temp\elxplorerehzpb.exe
  "C:\Users\Admin\AppData\Local\Temp\elxplorerehzpb.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D09.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpath.ini

Filesize
102B

MD5
e9cb0557b56f0af63e903e5fd68794a6

SHA1
0714215d02cb0e1336d8b22cb019f0131807651d

SHA256
21887c6f5c82025d791c91d8b09ad8634441261d75f555a683c93200f838d2f4

SHA512
3ff403e30fa12b4c2b23b0070205ec83eed2cf5fc3f67d91b8fb354307f0cd61f00c5bcae39286e01245e6329827686ddd7c73b6e908308a05ff99a697ab7834

Download Submit
\Users\Admin\AppData\Local\Temp\elxplorerehzpb.exe

Filesize
452KB

MD5
0e561c950a5a38883fd638ee103e4119

SHA1
3eab9bfdb5a76b28e71423076de576dcf38e4d16

SHA256
246d0d44c8a738876a596ae4af2835fdacb675d802237c52685e42405726d1c2

SHA512
e369e90f24290540bfeecfe7115f7442bac645aee275d7e9061cc2bcc93a4c83669569b60055cd12d14eab92310d75b78f31fd12585c00ac2de762809ea3ac86

Download Submit
memory/764-0-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/764-11-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/764-21-0x0000000003B10000-0x0000000003B83000-memory.dmp

Filesize
460KB

Download
memory/2600-22-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2600-146-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download