blackmoon | 57522c2c58604834f1f1e7236d63a375503a788b805a47df738ae3663388a4bb

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 02:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-30_e711531569d2e446c3501c635b41e89c_icedid_magniber_sakula.exe
Size

22.3MB
MD5

e711531569d2e446c3501c635b41e89c
SHA1

e414d12a763ac179385df2da92267946540a4cbb
SHA256

57522c2c58604834f1f1e7236d63a375503a788b805a47df738ae3663388a4bb
SHA512

ce0f1b8a3618be5a63cf69d8cab54e1a9bb368a5952214cad2a71ed14acbd1d910a56c5c34465bf1eda92040ac61d459e64ba3e3ff1835bca5796b22ad583a5c
SSDEEP

393216:sY9mGvCEJi1BEmEC0QuImhIKjWcgjB8IU7oKrZAQMu4G+56d0jSBufcOIlXESZ8K:sYsYCEJi1BEnvQu7vja8IDKrZMu4GwjA

Score

10^/10

blackmoon banker discovery trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 5 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\Documents\Tomcat.exe	family_blackmoon
behavioral2/memory/4700-30-0x0000000000B90000-0x0000000000DDE000-memory.dmp	family_blackmoon
behavioral2/memory/4700-34-0x0000000000B90000-0x0000000000DDE000-memory.dmp	family_blackmoon
behavioral2/memory/4700-36-0x0000000000B90000-0x0000000000DDE000-memory.dmp	family_blackmoon
behavioral2/memory/4700-39-0x0000000000B90000-0x0000000000DDE000-memory.dmp	family_blackmoon

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-06-30_e711531569d2e446c3501c635b41e89c_icedid_magniber_sakula.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	2024-06-30_e711531569d2e446c3501c635b41e89c_icedid_magniber_sakula.exe

Drops startup file 1 IoCs

Processes:

Tomcat.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WPS.lnk Tomcat.exe
Executes dropped EXE 1 IoCs

Processes:

Tomcat.exe

pid process

4700 Tomcat.exe
Loads dropped DLL 1 IoCs

Processes:

Tomcat.exe

pid process

4700 Tomcat.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WPS.lnk	Tomcat.exe

pid	process
4700	Tomcat.exe

pid	process
4700	Tomcat.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4996-2-0x0000000010000000-0x0000000010014000-memory.dmp	upx
behavioral2/memory/4996-3-0x0000000010000000-0x0000000010014000-memory.dmp	upx
behavioral2/memory/4700-28-0x0000000000B70000-0x0000000000B88000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

2024-06-30_e711531569d2e446c3501c635b41e89c_icedid_magniber_sakula.exeTomcat.exe

pid	process
4996	2024-06-30_e711531569d2e446c3501c635b41e89c_icedid_magniber_sakula.exe
4996	2024-06-30_e711531569d2e446c3501c635b41e89c_icedid_magniber_sakula.exe
4996	2024-06-30_e711531569d2e446c3501c635b41e89c_icedid_magniber_sakula.exe
4996	2024-06-30_e711531569d2e446c3501c635b41e89c_icedid_magniber_sakula.exe
4700	Tomcat.exe
4700	Tomcat.exe
4700	Tomcat.exe
4700	Tomcat.exe
4700	Tomcat.exe
4700	Tomcat.exe
4700	Tomcat.exe
4700	Tomcat.exe
4700	Tomcat.exe
4700	Tomcat.exe
4700	Tomcat.exe
4700	Tomcat.exe
4700	Tomcat.exe
4700	Tomcat.exe
4700	Tomcat.exe
4700	Tomcat.exe
4700	Tomcat.exe
4700	Tomcat.exe
4700	Tomcat.exe
4700	Tomcat.exe
4700	Tomcat.exe
4700	Tomcat.exe
4700	Tomcat.exe
4700	Tomcat.exe
4700	Tomcat.exe
4700	Tomcat.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

Tomcat.exe

description	pid	process
Token: SeDebugPrivilege	4700	Tomcat.exe
Token: SeLockMemoryPrivilege	4700	Tomcat.exe
Token: SeCreateGlobalPrivilege	4700	Tomcat.exe
Token: SeBackupPrivilege	4700	Tomcat.exe
Token: SeRestorePrivilege	4700	Tomcat.exe
Token: SeShutdownPrivilege	4700	Tomcat.exe
Token: SeCreateTokenPrivilege	4700	Tomcat.exe
Token: SeTakeOwnershipPrivilege	4700	Tomcat.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2024-06-30_e711531569d2e446c3501c635b41e89c_icedid_magniber_sakula.exe

pid process

4996 2024-06-30_e711531569d2e446c3501c635b41e89c_icedid_magniber_sakula.exe
4996 2024-06-30_e711531569d2e446c3501c635b41e89c_icedid_magniber_sakula.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-06-30_e711531569d2e446c3501c635b41e89c_icedid_magniber_sakula.exe

description	pid	process	target process
PID 4996 wrote to memory of 4700	4996	2024-06-30_e711531569d2e446c3501c635b41e89c_icedid_magniber_sakula.exe	Tomcat.exe
PID 4996 wrote to memory of 4700	4996	2024-06-30_e711531569d2e446c3501c635b41e89c_icedid_magniber_sakula.exe	Tomcat.exe
PID 4996 wrote to memory of 4700	4996	2024-06-30_e711531569d2e446c3501c635b41e89c_icedid_magniber_sakula.exe	Tomcat.exe

C:\Users\Admin\AppData\Local\Temp\2024-06-30_e711531569d2e446c3501c635b41e89c_icedid_magniber_sakula.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-30_e711531569d2e446c3501c635b41e89c_icedid_magniber_sakula.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996

C:\Users\Admin\Documents\Tomcat.exe
"C:\Users\Admin\Documents\Tomcat.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4700

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Ling\malloc\L_mimalloc.dll
Filesize
148KB

MD5
051d69a619adca3472e8d7c9b0c0eb5c

SHA1
6cc795ac90e43e408919e19ba6f5633863560459

SHA256
feefc12464985e2057a4cbd54117e9414f2e00a284106fa38b62d63052a1f7dd

SHA512
50daa3344aa4d86cdd22cf5736eec993467e6574c5e341cd0fd95757c739e167b6e76c744b29ae302d08c88d469fea0767640a9257f54f9dec2c5fbb87c23b71

Download Submit
C:\Users\Admin\Documents\Tomcat.exe
Filesize
2.2MB

MD5
aad4360f411a6d350f1b5b3c01526ae3

SHA1
259f5168038ae9beef7b2e98b5ae58eb46718b21

SHA256
6b894a62bb0892ad1cdd5b71ba976b974b343778e4860e55759d4cf89da2ee76

SHA512
6891f91e0f760f61303026867c91c37d63c0a5fda7687d6f07d171be2672b9811ef9aa59bca790c78ca3a3659784cea8ac5bc37b5bca5f5110592c275084cadc

Download Submit
C:\Users\Admin\Documents\conf.ini
Filesize
226B

MD5
768e73f80e36c330c69601f4cb724810

SHA1
ce56dcd9a6e73fea3c8d33011eaa1557d1e5cdfb

SHA256
94f54f53720bb8fd50dd8c91cc630b9f1c3ff4be0ea0383b3749b84a5417b0cf

SHA512
f6563f2dbcc8e3503f938827f4aafe4983a48b5d5f2537850632b8fe99f0a4cc7b00863bf63aa1b74545b0cf469ea7533b9c7ca37e9877fd83dbb0669d3bc88c

Download Submit
memory/4700-29-0x0000000000BE8000-0x0000000000BE9000-memory.dmp

Filesize
4KB

Download
memory/4700-15-0x0000000010000000-0x0000000010109000-memory.dmp

Filesize
1.0MB

Download
memory/4700-30-0x0000000000B90000-0x0000000000DDE000-memory.dmp

Filesize
2.3MB

Download
memory/4700-32-0x0000000002860000-0x00000000028B9000-memory.dmp

Filesize
356KB

Download
memory/4700-28-0x0000000000B70000-0x0000000000B88000-memory.dmp

Filesize
96KB

Download
memory/4700-21-0x0000000000A20000-0x0000000000A4B000-memory.dmp

Filesize
172KB

Download
memory/4700-34-0x0000000000B90000-0x0000000000DDE000-memory.dmp

Filesize
2.3MB

Download
memory/4700-36-0x0000000000B90000-0x0000000000DDE000-memory.dmp

Filesize
2.3MB

Download
memory/4700-37-0x0000000002860000-0x00000000028B9000-memory.dmp

Filesize
356KB

Download
memory/4700-39-0x0000000000B90000-0x0000000000DDE000-memory.dmp

Filesize
2.3MB

Download
memory/4996-3-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/4996-1-0x0000000006B60000-0x0000000006B87000-memory.dmp

Filesize
156KB

Download
memory/4996-2-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download