Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 15:32
Static task
static1
Behavioral task
behavioral1
Sample
f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe
Resource
win7-20240221-en
General
-
Target
f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe
-
Size
10.6MB
-
MD5
35bfeff634963ed20a003eec45e21d7e
-
SHA1
d4a5d090b05a0643cc8f01581939f98ba6587fa3
-
SHA256
f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a
-
SHA512
ad5bead049e4e518798cddd76cce0d17aeac818dfd1ad71d6da37da112f1d3de51bd7eef2f5af536d63f1734d5ef39755f8658afad0d61e08a47ab4d3447d417
-
SSDEEP
196608:10/mS2KWUGNEoiN/A4sLhg6jr7fNVIpiNYUpbimDV591R/ioEe3qorBOMSh:iOupGNvLC6jrZVIQNYiumJ/vJaoyh
Malware Config
Signatures
-
Detect Blackmoon payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/2192-6-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon behavioral1/memory/2192-7-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon behavioral1/memory/2192-10-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon behavioral1/memory/2192-9-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon behavioral1/memory/2192-8-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon behavioral1/memory/2192-32-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon behavioral1/memory/2192-33-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon behavioral1/memory/2192-35-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon behavioral1/memory/2192-36-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exedescription ioc process File opened (read-only) \??\V: f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe File opened (read-only) \??\X: f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe File opened (read-only) \??\B: f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe File opened (read-only) \??\I: f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe File opened (read-only) \??\K: f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe File opened (read-only) \??\N: f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe File opened (read-only) \??\W: f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe File opened (read-only) \??\G: f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe File opened (read-only) \??\J: f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe File opened (read-only) \??\O: f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe File opened (read-only) \??\S: f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe File opened (read-only) \??\A: f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe File opened (read-only) \??\E: f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe File opened (read-only) \??\P: f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe File opened (read-only) \??\Y: f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe File opened (read-only) \??\R: f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe File opened (read-only) \??\T: f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe File opened (read-only) \??\U: f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe File opened (read-only) \??\Z: f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe File opened (read-only) \??\H: f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe File opened (read-only) \??\L: f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe File opened (read-only) \??\M: f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe File opened (read-only) \??\Q: f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe -
Processes:
f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exepid process 2192 f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe 2192 f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe 2192 f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe"C:\Users\Admin\AppData\Local\Temp\f736f8eef1cb29c360f77b181182f2b4dd0f2af2826b19ebb65ea100af66221a.exe"1⤵
- Enumerates connected drives
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2192-0-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/2192-1-0x0000000000230000-0x0000000000233000-memory.dmpFilesize
12KB
-
memory/2192-5-0x00000000004FF000-0x0000000000500000-memory.dmpFilesize
4KB
-
memory/2192-6-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/2192-7-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/2192-10-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/2192-9-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/2192-8-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/2192-32-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/2192-33-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/2192-34-0x0000000000230000-0x0000000000233000-memory.dmpFilesize
12KB
-
memory/2192-35-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/2192-36-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB