Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 15:38
Behavioral task
behavioral1
Sample
??????.exe
Resource
win7-20240508-en
General
-
Target
??????.exe
-
Size
13.2MB
-
MD5
4d65014ca7fab35caae9d8ac24815e4b
-
SHA1
55d201d950e1053905f191f437962ea4992dbe86
-
SHA256
7d1e09800698caf357c17ddc003e443143a9748230a04acbcb0d3487a0a622c4
-
SHA512
bb668f2a0b42af7b7602c2a016966dace91144d21f9aee03a685190a172b3310dd580fcdac5bc1d3ec68b95fd52c01ceb2a48f1adbd4c13aebe07c1e1130dc19
-
SSDEEP
393216:gPDPWrjWiaqTjWU5JUkCoAvpyS+Vb3izzn72YZ:YKO8JUN0b+zSYZ
Malware Config
Signatures
-
Detect Blackmoon payload 14 IoCs
Processes:
resource yara_rule behavioral1/memory/2932-2-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/2932-1-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/2932-3-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/2932-8-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/2932-12-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/2932-11-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/2932-10-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/2932-9-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/2756-52-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/2756-50-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/2932-51-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/2756-49-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/2756-82-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/2756-83-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon -
Processes:
resource yara_rule \¡ïÎåÑò³ÁĬ¡ï\20988______.exe aspack_v212_v242 -
Executes dropped EXE 1 IoCs
Processes:
20988______.exepid process 2756 20988______.exe -
Loads dropped DLL 1 IoCs
Processes:
______.exepid process 2932 ______.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
______.exedescription ioc process File opened (read-only) \??\H: ______.exe File opened (read-only) \??\L: ______.exe File opened (read-only) \??\M: ______.exe File opened (read-only) \??\O: ______.exe File opened (read-only) \??\Q: ______.exe File opened (read-only) \??\X: ______.exe File opened (read-only) \??\B: ______.exe File opened (read-only) \??\E: ______.exe File opened (read-only) \??\J: ______.exe File opened (read-only) \??\T: ______.exe File opened (read-only) \??\Y: ______.exe File opened (read-only) \??\Z: ______.exe File opened (read-only) \??\G: ______.exe File opened (read-only) \??\I: ______.exe File opened (read-only) \??\N: ______.exe File opened (read-only) \??\S: ______.exe File opened (read-only) \??\U: ______.exe File opened (read-only) \??\V: ______.exe File opened (read-only) \??\W: ______.exe File opened (read-only) \??\A: ______.exe File opened (read-only) \??\K: ______.exe File opened (read-only) \??\P: ______.exe File opened (read-only) \??\R: ______.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
______.exe20988______.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main ______.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main 20988______.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
______.exe20988______.exepid process 2932 ______.exe 2932 ______.exe 2932 ______.exe 2756 20988______.exe 2756 20988______.exe 2756 20988______.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
______.exedescription pid process target process PID 2932 wrote to memory of 2756 2932 ______.exe 20988______.exe PID 2932 wrote to memory of 2756 2932 ______.exe 20988______.exe PID 2932 wrote to memory of 2756 2932 ______.exe 20988______.exe PID 2932 wrote to memory of 2756 2932 ______.exe 20988______.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\______.exe"C:\Users\Admin\AppData\Local\Temp\______.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\¡ïÎåÑò³ÁĬ¡ï\20988______.exeC:\¡ïÎåÑò³ÁĬ¡ï\20988______.exe2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G17BROQF\httpErrorPagesScripts[1]Filesize
8KB
MD53f57b781cb3ef114dd0b665151571b7b
SHA1ce6a63f996df3a1cccb81720e21204b825e0238c
SHA25646e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad
SHA5128cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TTL9DZJ3\errorPageStrings[1]Filesize
2KB
MD5e3e4a98353f119b80b323302f26b78fa
SHA120ee35a370cdd3a8a7d04b506410300fd0a6a864
SHA2569466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66
SHA512d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee
-
C:\Users\Admin\AppData\Local\Temp\42056c46bc4e087c47a0de482530e13e.txtFilesize
16B
MD50f6f301a359dfda81ee72a4f6cabbb30
SHA1a49a51882cb334df7fc80b87a51a241f6b6cf09e
SHA256f9f4d903b7f52a0ec9ade6018f4f2d23d3493c5b2c0b341ce40170e33c1831ee
SHA512b3a7adf414a76448423c7fa428375681cb30ce8cd270d1aa0381e18a74ce4d3c03c3cc7969a542c443adb30b8982f96be3df2062c9de15eb9b37b1de69fa70cb
-
\¡ïÎåÑò³ÁĬ¡ï\20988______.exeFilesize
13.2MB
MD54d65014ca7fab35caae9d8ac24815e4b
SHA155d201d950e1053905f191f437962ea4992dbe86
SHA2567d1e09800698caf357c17ddc003e443143a9748230a04acbcb0d3487a0a622c4
SHA512bb668f2a0b42af7b7602c2a016966dace91144d21f9aee03a685190a172b3310dd580fcdac5bc1d3ec68b95fd52c01ceb2a48f1adbd4c13aebe07c1e1130dc19
-
memory/2756-49-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/2756-52-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/2756-83-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/2756-82-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/2756-48-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/2756-50-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/2932-9-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/2932-46-0x000000000CE10000-0x000000000D336000-memory.dmpFilesize
5.1MB
-
memory/2932-7-0x000000000091E000-0x000000000091F000-memory.dmpFilesize
4KB
-
memory/2932-8-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/2932-51-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/2932-0-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/2932-10-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/2932-3-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/2932-1-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/2932-2-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/2932-11-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/2932-12-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB