blackmoon | af9fd96e4a0de2860cb9ed5e8f3a70cf55e1d6f4c910e33c91c4d8b6413ffb2f

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 04:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe
Size

259KB
MD5

f9f5342074462fa1048fea806eef535f
SHA1

61c4e925d54b4e85564abb2a233b976306ee4e74
SHA256

5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd
SHA512

5b1823ae6153f30e9c24b2240aea2610f5f05182ae66b933122721d312d8fae8ef8ca3cdfe03b4f316e12c7e45acfe0f1fcdd35f5b81748477f27477ce00b9b9
SSDEEP

6144:r+k9IKKJPa1DyKHC055swEUkezQ12rqyFWaiwV:ik9IKKJip9C0kmzQ12rqyQaX

Score

10^/10

blackmoon gh0strat banker persistence rat trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon
Detect Blackmoon payload 2 IoCs

Processes:

resource yara_rule

\Users\Admin\AppData\Local\Temp\MSSQLH.exe family_blackmoon
behavioral1/memory/616-13-0x0000000000400000-0x00000000004CF000-memory.dmp family_blackmoon

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MSSQLH.exe	family_blackmoon
behavioral1/memory/616-13-0x0000000000400000-0x00000000004CF000-memory.dmp	family_blackmoon

Gh0st RAT payload 6 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MSSQLH.exe	family_gh0strat
\Windows\Logs\RunDllExe.dll	family_gh0strat
behavioral1/memory/1260-12-0x0000000000400000-0x0000000000409000-memory.dmp	family_gh0strat
behavioral1/memory/1260-11-0x0000000000400000-0x0000000000409000-memory.dmp	family_gh0strat
behavioral1/memory/616-13-0x0000000000400000-0x00000000004CF000-memory.dmp	family_gh0strat
behavioral1/memory/1260-14-0x0000000000400000-0x0000000000409000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Boot or Logon Autostart Execution: Port Monitors 1 TTPs 2 IoCs

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

persistence

Port Monitors

T1547.010

Processes:

MSSQLH.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\RunDllExe	MSSQLH.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\RunDllExe\Driver = "C:\\Windows\\Logs\\RunDllExe.dll"	MSSQLH.exe

Executes dropped EXE 2 IoCs

Processes:

MSSQLH.exe

pid process

1708 MSSQLH.exe
1004
Loads dropped DLL 2 IoCs

Processes:

5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe

pid process

616 5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe
616 5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

behavioral1/memory/616-0-0x0000000000400000-0x00000000004CF000-memory.dmp upx
behavioral1/memory/616-13-0x0000000000400000-0x00000000004CF000-memory.dmp upx
Drops file in System32 directory 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat svchost.exe
Drops file in Windows directory 1 IoCs

Processes:

MSSQLH.exe

description ioc process

File created C:\Windows\Logs\RunDllExe.dll MSSQLH.exe

pid	process
1708	MSSQLH.exe
1004

pid	process
616	5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe
616	5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe

resource	yara_rule
behavioral1/memory/616-0-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral1/memory/616-13-0x0000000000400000-0x00000000004CF000-memory.dmp	upx

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svchost.exe

description	ioc	process
File created	C:\Windows\Logs\RunDllExe.dll	MSSQLH.exe

Modifies data under HKEY_USERS 28 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{43C94297-09D6-4250-A7D2-668F5D09A1EB}\WpadDecisionReason = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-54-90-6c-76-2f\WpadDecision = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-54-90-6c-76-2f\WpadDecisionTime = 90605e876dcbda01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{43C94297-09D6-4250-A7D2-668F5D09A1EB}\WpadDecisionTime = 301598ad6dcbda01	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{43C94297-09D6-4250-A7D2-668F5D09A1EB}\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{43C94297-09D6-4250-A7D2-668F5D09A1EB}\aa-54-90-6c-76-2f	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{43C94297-09D6-4250-A7D2-668F5D09A1EB}	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{43C94297-09D6-4250-A7D2-668F5D09A1EB}\WpadDecisionTime = 90605e876dcbda01	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0022000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-54-90-6c-76-2f	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-54-90-6c-76-2f\WpadDecisionTime = 301598ad6dcbda01	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{43C94297-09D6-4250-A7D2-668F5D09A1EB}\WpadNetworkName = "Network 3"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-54-90-6c-76-2f\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-54-90-6c-76-2f\WpadDetectedUrl	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0022000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

MSSQLH.exe

pid process

1708 MSSQLH.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exeMSSQLH.exe

pid process

616 5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe
1708 MSSQLH.exe

pid	process
1708	MSSQLH.exe

pid	process
616	5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe
1708	MSSQLH.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe

description	pid	process	target process
PID 616 wrote to memory of 1708	616	5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe	MSSQLH.exe
PID 616 wrote to memory of 1708	616	5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe	MSSQLH.exe
PID 616 wrote to memory of 1708	616	5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe	MSSQLH.exe
PID 616 wrote to memory of 1708	616	5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe	MSSQLH.exe

C:\Users\Admin\AppData\Local\Temp\5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe
"C:\Users\Admin\AppData\Local\Temp\5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616

C:\Users\Admin\AppData\Local\Temp\MSSQLH.exe
C:\Users\Admin\AppData\Local\Temp\MSSQLH.exe
2⤵
- Boot or Logon Autostart Execution: Port Monitors
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1708

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1260

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Port Monitors

T1547.010

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Port Monitors

T1547.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\MSSQLH.exe
Filesize
436KB

MD5
214f53c5c0181d9e0531c48d46ed0881

SHA1
4d5629a5fbb29439b66caf98c5cec56730118ecd

SHA256
224bf0bd119ef5c8aed25875cb66f62f9e2054dea8de5a3083cc43468a5da0da

SHA512
a941ec678f6eb05c3c7692dc5b297ccea552e30b0cdab123111e39527fd51a2b9b16b9956ecfccf05193518bee5478d7562c5a4b4e0338016032e5384cb19c5a

Download Submit
\Windows\Logs\RunDllExe.dll
Filesize
187KB

MD5
32f5f95ddcf6a0a189075be6c3afa9bc

SHA1
37895da8daf6c462c7d52213b90cb88688d96121

SHA256
284ab4c3428492f4e5c8fe57855a640a6ce87de1d20c03fe38decb211887a70a

SHA512
ac16cb916d3ee3eb412d7c0b9deef2efdc239fc2737296566549d1255372cbca7866b3221431d90775d088a58126d93964875a01aceb146c910f604e27555987

Download Submit
memory/616-0-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/616-13-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1260-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1260-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1260-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download