Old Blackmoon Trojan, NEW Monetization Approach

Main / Old Blackmoon Trojan, NEW Monetization Approach

Discription

![Old Blackmoon Trojan, NEW Monetization Approach](https://blog.rapid7.com/content/images/2023/07/GettyImages-1187008408–1-.jpg)

Rapid7 is tracking a new, more sophisticated and staged campaign using the Blackmoon trojan, which appears to have originated in November 2022. The campaign is actively targeting various businesses primarily in the USA and Canada. However, it is not used to steal credentials, instead it implements different evasion and persistence techniques to drop several unwanted programs and stay in victimsâ environment for as long as possible.

Blackmoon, also known as KRBanker, is a banking trojan [first spotted]() in late September 2015 when targeting banks of the Republic of Korea. Back in 2015, it was using a âpharmingâ technique to steal credentials from targeted victims. This technique involves redirecting traffic to a forged website when a user attempts to access one of the banking sites being targeted by the cyber criminals. The fake server masquerades the original site and urges visitors to submit their information and credentials.

![Old Blackmoon Trojan, NEW Monetization Approach](https://blog.rapid7.com/content/images/2023/07/Flowchart-1.png)

**Stage 1 – Blackmoon**

Blackmoon trojan was named after a debug string âblackmoon,â that is present in its code:

![Old Blackmoon Trojan, NEW Monetization Approach](https://lh4.googleusercontent.com/qNgFH_KGO7HuOO7oO28saOkhRutuBuOpG3AI1voDIS4kBVbla_X8v8VHkVku7e1Ql3PIFjEfOqrAHRIMrcAn-SnX7JIiVfz700at7nMYHefKt6aJah0Kt7KSypYgBiUeV6oryBZVIiYUdtd4gP8T-uo)Blackmoon string found inside malware’s code

Blackmoon drops a dll into `C:WindowsLogs` folder named `RunDllExe.dll` and implements a [Port Monitors]() persistence technique. Port Monitors is related to the Windows Print Spooler Service or `spoolsv.exe`. When adding a printer port monitor a user (or the attacker in our case) has the ability to add an arbitrary dll that acts as the monitor. There are two ways to add a port monitor: via Registry for persistence or via a [AddMonitor]() API call for immediate dll execution.

Our sample implements both, it calls [AddMonitor]() API call to immediately execute `RunDllExe.dll`:

![Old Blackmoon Trojan, NEW Monetization Approach](https://lh5.googleusercontent.com/zNYEZ9Zvs64adX9BxdQ9LpSr4G_HmskSVSUGXVQr5OTw5gX4pARuq3YbpMrvhP3QqyAArVIX8ZFQMrwiCLhFCs-obKughGB04s7bOSEaNP8PPrnlXOwY-tBN1Hnz6lEChfQ2cA6yvxwQsigfjZc3Cf8)AddMonitorA API call

It also sets a Driver value in `HKLMSYSTEMCurrentControlSetControlPrintMonitorsRunDllExe` registry key to the malicious dll path.

![Old Blackmoon Trojan, NEW Monetization Approach](https://lh3.googleusercontent.com/R8i0iyHQNp12_I2LlpMpp7xbahqo5Rb54GsYbkTEUjnLNOrpVFVtpQDG_VSjn0vTz_zsBzEM98q5zccBfY0v5ENV_51B5dKbpkTmEpWVLK5by9ybUPYvHDdplrQwZKhzK6ZiptxcR2oC-p7LPcrASug)Driver value set under monitors registry key

Next, the malware adds a shutdown system privilege to the Spooler service by adding `SeShutdownPrivilege` to the `RequiredPrivileges` value of `HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSpooler` registry key.

![Old Blackmoon Trojan, NEW Monetization Approach](https://lh4.googleusercontent.com/MU9huBAoB_lSKAnaLU_bsK8nVXZHjvfFtnLXJabQK4cXvs9G6TmfsL4Vr1rqs9KtCezSZQKTTsHTzlNNeW9OGo_m9W2npKNSsg4R1jWhRx8DmzRHYBlQ4pRsM1NSE-_Rh-k3_Apxl8Orls189EzWs30)![Old Blackmoon Trojan, NEW Monetization Approach](https://lh5.googleusercontent.com/8O3D32LztPLIJbdKXYZyVR2uIh69E1DlPwYWFtVKX-9c8D9pbluArkMf9jq_BKOIN9QI1e8ZVgvLn6h2abj0e_sTntiBrDWcvP0YUgPU3FmSp1H6s7-ezZcFm_MIfedNpLimQggsRjSqfmyDI0dd6p8)RequiredPrivileges data before and after the update

The malware disables Windows Defender by setting `HKLMSOFTWAREPoliciesMicrosoftWindows DefenderDisableAntiSpyware` value to â1â.

It also stops and disables âLanmanâ service (the service that allows a computer to share files and printers with other devices on the network).

To block all incoming RPC and SMB communication the malware executes the set of following commands:

netsh ipsec static add policy name=Block
netsh ipsec static add filterlist name=Filter1
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP
netsh ipsec static add filteraction name=FilteraAtion1 action=block
netsh ipsec static add rule name=Rule1 policy=Block filterlist=Filter1 filteraction=FilteraAtion1
netsh ipsec static set policy name=Block assign=y

The malware sets two additional values under `HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesaspnet_staters`: Work and Mining, both set to â1â.

Next, the malware checks if one of the following services exists on the victim computer:

* clr_optimization_v3.0.50727_32
* clr_optimization_v3.0.50727_64
* WinHelpsvcs
* Services
* Help Service
* KuGouMusic
* WinDefender
* Msubridge
* ChromeUpdater
* MicrosoftMysql
* MicrosoftMssql
* Conhost
* MicrosotMaims
* MicrosotMais

In case the service is found, it will be disabled (by setting âStartâ value under `HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesservicename` to â4â) or deleted by using DeleteService API call.

The malware enumerates running processes by using a combination of `CreateToolhelp32Snapshot` and `Process32First` and `Process32Next` API calls to terminate serviceâs process if one is running.

Finally, a Powershell command is executed to delete the running processâs file and the malware exits.

**Stage 2 – RunDllExe.dll – injector**

`RunDllExe.dll` is executed by Spooler service and is responsible for injecting a next stage payload into the newly executed `svchost.exe` process. The malware implements [Process Hollowing]() injection technique. The injected code is a C++ file downloader.

**Stage 3 – File Downloader**

The downloader first checks if âWorkâ and âMiningâ values exist and set under `HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesaspnet_staters` registry key, if the values do not exist, it will create them and set both to “1”.

As downloader, this part of the attack flow is checking if all needed to be downloaded files are already present (by using `PathFileExistsA` API call) on the PC, if not, the malware sleeps for two minutes before every download and then use the `URLDownloadToFileA` API call to download the following files:

* C:WINDOWSTempMpMgSvc.dll
* C:WINDOWSTempHooks.exe
* C:WINDOWSTempMpMgSvc.exe
* C:WindowsMicrosoft.NETFrameworkv3.0WmiPrvSER.exe

After the download all but the `MpMgSvc.dll` are executed by the downloader:

![Old Blackmoon Trojan, NEW Monetization Approach](https://lh6.googleusercontent.com/bCfjP6UMJbuHj8pahXh0dVuFGjkoqchIAPPlDyct5YekDo6no8qjyLA4LBRO9Uhrazs3FiXCtJwGYNxbXn8vrCcH0SCrhqiuyE9g7mp9XwPxabMDxmsgONuDq2sG1HRzxleTuivICm0dPfJtqvY3FsM)Execution tree

**Stage 4 – Hook.exe – dropper**

`Hook.exe` drops an additional dll to the users roaming folder `C:UsersUsernameAppDataRoamingGraphicsPerfSvcs.dll` and creates a new service named `GraphicsPerfSvcs`, which will be automatically executed at system startup. The service name is almost identical to the legitimate service named `GraphicsPerfSvc`, which belongs to the Graphics performance monitor service. Naming services and files similarly to the once belonged to OS is an evasion technique widely used by threat actors.

![Old Blackmoon Trojan, NEW Monetization Approach](https://lh5.googleusercontent.com/IPqjhy5ZtcrtUtyL3OibRKl_prC3xXFE9wZNZ4uWsgr5sYhiHNn_uc_LOWSYfvrN3rbbH6fke0pDfIAeUr0Lm7duoXnbPU2lNL6SS3cR6a_1vvg2tgr0aiNQ0ko4qtCvhaoLliQrt2nzhj9cyOekJo0)Malicious Service under the legitimate one

The dropper starts the created service. It then creates and executes a .vbs which responsible for deleting `Hook.exe` and the .vbs itself:

![Old Blackmoon Trojan, NEW Monetization Approach](https://lh6.googleusercontent.com/YUGfRjUi_C0I-T1nzoKiWaDFNVIDRfeEUMSmQcHa0j6wSVDx8bNb6HUQlcO4QBNFmYK4V7MIGZE-w0-9qrdJ-N4U-htDWzktOtLi4LCw4SKGUBkG7niM0U1UF6N1YLm-xyOZbJ4l7Cx962FzoEKVmBc)Created .vbs

**Stage 4.1 – MpMgSvc.exe – spreader **`MpMgSvc.exe` first creates a new `BaseNamedObjectsBrute_2022` mutex. As being responsible for spreading the malware, it drops `Doublepulsar-1.3.1.exe`, `Eternalblue-2.2.0.exe`, `Eternalromance-1.4.0.exe` and all required for these files libraries into the C:WindowsTemp folder.

Then it scans the network for PCâs with open 3306, 445, 1433 ports. If any open ports are found, the spreader will attempt to install a backdoor by using EternalBlue and send shellcode to inject dll with Doublepulsar as implemented in the Eternal-Pulsar[ github project]() .

![Old Blackmoon Trojan, NEW Monetization Approach](https://lh5.googleusercontent.com/JeqMJfUOweKnXulnM0lrzdUGMCV8WzRP0t8do9SL0GqUbNSGymNWTZwQaeWH3T7i_9HrPuAjgNSNaQcqlA3Z4LPdK6tO9W7lbzzNAhBFPl5VTIIpuqMvt1lAVkN7-BNWlidl8nwXpX0hzxozA8RRpPA)Eternal-Pulsar commands in spreader memoryââ

There are two dlls dropped, one for x64 architecture and the second one for x86. When injected by Doublepulsar it will download the first stage Blackmoon malware and follow the same execution stages described in this analysis.

**Stage 4.2 – WmiPrvSER.exe – XMRig miner**

`WmiPrvSER.exe` is a classic XMRig Monero miner. Our sample is the XMRig version 6.18, and it creates a `BaseNamedObjects\Win__Host` mutex on the victim’s host.** **You can find a full report on XMRig [here]().

**Stage 5 – GraphicsPerfSvcs service – dropper**

As mentioned in the previous stage, the `GraphicsPerfSvcs` service will be started automatically at system startup. Every time it runs, it will check if two of the following files exist:

* C:WindowsTEMPctfmoon.exe
* C:WindowsMicrosoft.NETtraffmonetizerTraffmonetizer.exe

If not found, it will drop both those files and all needed dlls for their execution.

The dropper also creates two new firewall rules that allow all outbound connections from dropped files by executing the following commands:

* `netsh advfirewall firewall add rule name=ctfmoon dir=out program=C:WindowsMicrosoft.NETctfmoon.exe action=allow`
* `netsh advfirewall firewall add rule name=traffmonetizer dir=out program=C:WindowsMicrosoft.NETtraffmonetizertraffmonetizer.exe action=allow`

![Old Blackmoon Trojan, NEW Monetization Approach](https://lh4.googleusercontent.com/wbNP1Tbp31V7R-lDWRyeS9YesRP3bmVTUz2NfvVrbJ5rJcLh8aTh-E5J1_wShrl_LjtPK5XYAliMWwjG3skd_LsIbRBwxq6vmxGW2UqDBAONddfsSbpr2u8TnJvEK3lvPP1LJydXF0Y1r9YPSOThITY)Ctfmoon.exe firewall rule creation

The service stays up and constantly attempts to read from the URL: hxxp://down.ftp21[.]cc/Update.txt. At the time of the analysis, this URL was down so we were not able to observe its content. However, following the service code, it seems to read the URL content and check if it contains one of the following commands:

`[Delete File]`, `[Kill Proccess]`, or `[Delete Service]`, which will delete file, kill process or delete service accordingly.

**Stage 6 – Ctfmoon.exe and Traffmonetizer.exe – Traffic Stealers**

`GraphicsPerfSvcs` service executes two dropped files: `Ctfmoon.exe` and `Traffmonetizer.exe`**, **both appeared to be Potentially Unwanted Programs (PUPâs) in the form of traffic stealers. Both software are using the ânetwork bandwidth sharingâ monetization scheme to make âpassive incomeâ.

`Ctfmoon.exe` is a cli version of the [Iproyal Pawns]() application. It gets the user email address and password as execution parameters to associate the activity and collect the money to the passed account. `GraphicsPerfSvcs` executes the following command line to start the Iproyal Pawns: `ctfmoon.exe [email protected] -password=123456Aa. -device-name=Win32 -accept-tos`

We can see that the user mentioned in our execution parameters already made $169:

![Old Blackmoon Trojan, NEW Monetization Approach](https://lh4.googleusercontent.com/xYUe6CwgljRhmzndi85lfWuZG1tQRQ7T7xIvfUeOdFH3KdLpD5ra1r-K9w4vE_ZgehN1BNF2vsKm2VBZwb8Nc-p1JQJEWsgXKJrfyBRkIyr4lPdnlchw5iTrCMcOVtK5PF6Hwdjqj3F18aO_oDJ00ws)Iproyal Pawns earnings from our sample

The `Traffmonetizer.exe` is similar to `Ctfmoon.exe`, created by [Traffmonetizer](). It reads the user account data from a settings.json file dropped in users roaming directory. Our .json file contains the following content:

`{“Token”:”1gUgURMzQiuGFgttIdjeZBS0G6fqFlVvhCKlqzfHd3o=”,”StartWithWindows”:false,”Accepting”:true}`.

## Conclusion

The analysis in this blog reveals the effort threat actors put into the attack flow, by using several evasion and persistence techniques and using different approaches to increase their income and use victim resources.

## MITRE ATT&CK Techniques:

Persistence | Boot or Logon Autostart Execution: Port Monitors (T1547.010) | The Blackmoon trojan (a95737adb2cd7b1af2291d143200a82d8d32 a868c64fb4acc542608f56a0aeda) is using Port Monitors technique to establish persistence on the target host.
—|—|—
Persistence | Create or Modify System Process: Windows Service (T1543.003) | The Hook.exe dropper (1A7A4B5E7C645316A6AD59E26054A95 654615219CC03657D6834C9DA7219E99F) creates a new service to establish persistence on the target host.
Defense Evasion | Process Injection: Process Hollowing (T1055.012) | The dll dropped by Blackmoon (F5D508C816E485E05DF5F58450D623DC6B FA35A2A0682C238286D82B4B476FBB) is using the process hollowing technique to evade endpoint security detection.
Defense Evasion | Impair Defenses: Disable or Modify Tools (T1562.001) | The Blackmoon trojan (a95737adb2cd7b1af2291d143200a82d8 d32a868c64fb4acc542608f56a0aeda) disables Windows Defender to evade end-point security detection.
Lateral Movement | Exploitation of Remote Services (T1210) | The MpMgSvc.exe spreader (72B0DA797EA4FC76BA4DB6AD131056257965D F9B2BCF26CE2189AF3DBEC5B1FC) uses EternalBlue and DoublePulsar to spread in organizationâs environment.
Discovery | Network Share Discovery (T1135) | The MpMgSvc.exe spreader (72B0DA797EA4FC76BA4DB6AD131056257965D F9B2BCF26CE2189AF3DBEC5B1FC) scans the network do discover open SMB ports.
Impact | Resource Hijacking (T1496) | The XMRing miner (ECC5A64D97D4ADB41ED9332E4C0F5DC7DC02 A64A77817438D27FC31C69F7C1D3), Iproyal Pawns trafficStealer (FDD762192D351CEA051C0170840F1D8D 171F334F06313A17EBA97CACB5F1E6E1) and Traffmonetizer trafficStealer (2923EACD0C99A2D385F7C989882B7CCA 83BFF133ECF176FDB411F8D17E7EF265) executed to use victimâs resources.
Impact | Service Stop (T1489) | The Blackmoon trojan (a95737adb2cd7b1af2291d143200a82d8d 32a868c64fb4acc542608f56a0aeda) stops updates and security products services.
Command and Control | Application Layer Protocol: Web Protocols (T1071.001) | The downloader (E9A83C8811E7D7A6BF7EA7A656041BCD68968 7F8B23FA7655B28A8053F67BE99) downloads next stage payloads over HTTP protocol.
GraphicsPerfSvcs service (5AF88DBDC7F53BA359DDC47C3BCAF3F5FE 9BDE83211A6FF98556AF7E38CDA72B) uses HTTP protocol to get command from C&C server.

## **IOCâs**

## References

* Read More

References

Back to Main

Subscribe for the latest news: