Overview

overview

10

Static

static

10

5d87bd723f...cd.exe

windows7-x64

10

5d87bd723f...cd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f9f5342074462fa1048fea806eef535f.bin

  • Size

    254KB

  • Sample

    240701-ev9cbswcpb

  • MD5

    4c812f8564b707afa05bea3d2e39bbdf

  • SHA1

    e8be6e0c2888b8341a801f41038e5141142f3c70

  • SHA256

    af9fd96e4a0de2860cb9ed5e8f3a70cf55e1d6f4c910e33c91c4d8b6413ffb2f

  • SHA512

    b42b1283f855304684e4121339026ed6cf8ac35c116c5e0b0f3ea5ce371007113fe7c80c5658d55d0ffa2f3c832c1292d04650ec6fe606fce20d0e3a6e5f9e18

  • SSDEEP

    6144:KwGmO9R2mIuSjbM1ddO0fPLB7mNo4STnIcoBOBrd5MuAiaj:vGmu2mIuywjw0fP12STN6OBx+b

Score
10/10
blackmoongh0stratbankerdiscoveryevasionpersistenceprivilege_escalationrattrojanupx

Malware Config

Targets

    • Target

      5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe

    • Size

      259KB

    • MD5

      f9f5342074462fa1048fea806eef535f

    • SHA1

      61c4e925d54b4e85564abb2a233b976306ee4e74

    • SHA256

      5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd

    • SHA512

      5b1823ae6153f30e9c24b2240aea2610f5f05182ae66b933122721d312d8fae8ef8ca3cdfe03b4f316e12c7e45acfe0f1fcdd35f5b81748477f27477ce00b9b9

    • SSDEEP

      6144:r+k9IKKJPa1DyKHC055swEUkezQ12rqyFWaiwV:ik9IKKJip9C0kmzQ12rqyQaX

    Score
    10/10
    blackmoongh0stratbankerpersistencerattrojanupxdiscoveryevasionprivilege_escalation

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Boot or Logon Autostart Execution: Port Monitors

      Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

      persistence

    • Downloads MZ/PE file

    • Modifies Windows Firewall

      evasion

    • Server Software Component: Terminal Services DLL

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Port Monitors

1
T1547.010

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Server Software Component

1
T1505

Terminal Services DLL

1
T1505.005

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Port Monitors

1
T1547.010

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

Network Service Discovery

1
T1046

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks