Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 15:38
Behavioral task
behavioral1
Sample
??????.exe
Resource
win7-20240508-en
General
-
Target
??????.exe
-
Size
13.2MB
-
MD5
4d65014ca7fab35caae9d8ac24815e4b
-
SHA1
55d201d950e1053905f191f437962ea4992dbe86
-
SHA256
7d1e09800698caf357c17ddc003e443143a9748230a04acbcb0d3487a0a622c4
-
SHA512
bb668f2a0b42af7b7602c2a016966dace91144d21f9aee03a685190a172b3310dd580fcdac5bc1d3ec68b95fd52c01ceb2a48f1adbd4c13aebe07c1e1130dc19
-
SSDEEP
393216:gPDPWrjWiaqTjWU5JUkCoAvpyS+Vb3izzn72YZ:YKO8JUN0b+zSYZ
Malware Config
Signatures
-
Detect Blackmoon payload 8 IoCs
Processes:
resource yara_rule behavioral2/memory/1420-2-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral2/memory/1420-1-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral2/memory/1420-3-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral2/memory/1420-17-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral2/memory/1356-20-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral2/memory/1356-21-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral2/memory/1356-19-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral2/memory/1356-50-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon -
Processes:
resource yara_rule C:\¡ïÎåÑò³ÁĬ¡ï\26693______.exe aspack_v212_v242 -
Executes dropped EXE 1 IoCs
Processes:
26693______.exepid process 1356 26693______.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
______.exedescription ioc process File opened (read-only) \??\R: ______.exe File opened (read-only) \??\B: ______.exe File opened (read-only) \??\G: ______.exe File opened (read-only) \??\H: ______.exe File opened (read-only) \??\L: ______.exe File opened (read-only) \??\N: ______.exe File opened (read-only) \??\P: ______.exe File opened (read-only) \??\Q: ______.exe File opened (read-only) \??\S: ______.exe File opened (read-only) \??\V: ______.exe File opened (read-only) \??\Z: ______.exe File opened (read-only) \??\A: ______.exe File opened (read-only) \??\J: ______.exe File opened (read-only) \??\T: ______.exe File opened (read-only) \??\X: ______.exe File opened (read-only) \??\Y: ______.exe File opened (read-only) \??\K: ______.exe File opened (read-only) \??\O: ______.exe File opened (read-only) \??\W: ______.exe File opened (read-only) \??\E: ______.exe File opened (read-only) \??\I: ______.exe File opened (read-only) \??\M: ______.exe File opened (read-only) \??\U: ______.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
______.exe26693______.exepid process 1420 ______.exe 1420 ______.exe 1420 ______.exe 1356 26693______.exe 1356 26693______.exe 1356 26693______.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
______.exedescription pid process target process PID 1420 wrote to memory of 1356 1420 ______.exe 26693______.exe PID 1420 wrote to memory of 1356 1420 ______.exe 26693______.exe PID 1420 wrote to memory of 1356 1420 ______.exe 26693______.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\______.exe"C:\Users\Admin\AppData\Local\Temp\______.exe"1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\¡ïÎåÑò³ÁĬ¡ï\26693______.exeC:\¡ïÎåÑò³ÁĬ¡ï\26693______.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\42056c46bc4e087c47a0de482530e13e.txtFilesize
16B
MD50f6f301a359dfda81ee72a4f6cabbb30
SHA1a49a51882cb334df7fc80b87a51a241f6b6cf09e
SHA256f9f4d903b7f52a0ec9ade6018f4f2d23d3493c5b2c0b341ce40170e33c1831ee
SHA512b3a7adf414a76448423c7fa428375681cb30ce8cd270d1aa0381e18a74ce4d3c03c3cc7969a542c443adb30b8982f96be3df2062c9de15eb9b37b1de69fa70cb
-
C:\¡ïÎåÑò³ÁĬ¡ï\26693______.exeFilesize
13.2MB
MD54d65014ca7fab35caae9d8ac24815e4b
SHA155d201d950e1053905f191f437962ea4992dbe86
SHA2567d1e09800698caf357c17ddc003e443143a9748230a04acbcb0d3487a0a622c4
SHA512bb668f2a0b42af7b7602c2a016966dace91144d21f9aee03a685190a172b3310dd580fcdac5bc1d3ec68b95fd52c01ceb2a48f1adbd4c13aebe07c1e1130dc19
-
memory/1356-50-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/1356-19-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/1356-21-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/1356-20-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/1356-18-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/1420-3-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/1420-17-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/1420-7-0x0000000003C80000-0x0000000003C81000-memory.dmpFilesize
4KB
-
memory/1420-8-0x0000000003B10000-0x0000000003B11000-memory.dmpFilesize
4KB
-
memory/1420-9-0x00000000040E0000-0x00000000040E1000-memory.dmpFilesize
4KB
-
memory/1420-0-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/1420-1-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/1420-2-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB