Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 08:04
Behavioral task
behavioral1
Sample
155绿色软件站.url
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
155绿色软件站.url
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
QQ牧场宝贝.exe
Resource
win7-20240611-en
General
-
Target
QQ牧场宝贝.exe
-
Size
283KB
-
MD5
4b18c843d1f5aa5c0a0511d8137fb0ca
-
SHA1
3b7db3134a3a15a3683a1c198c0c972c58e507b5
-
SHA256
842536f9891fd3842e8a6b74c667391a1e11b4a552c34414bc48f61fdbdd6c1b
-
SHA512
721f613673650df4c0762bf03bfd9af4b34b2f437940baa98b9cf5623eacea24b6ba820917d4dc605a539f04fd196a4794647a2cb7c82fd0c294fb600290dc2c
-
SSDEEP
6144:6EBLkxedjZJv+91z0/RCLIEX8494VLAJaBf04vCt7ssYInY:6cLkxe1n+Tz0/+SZXBf0ECt7ssYInY
Malware Config
Signatures
-
Detect Blackmoon payload 1 IoCs
Processes:
resource yara_rule behavioral4/memory/3048-53-0x0000000000400000-0x000000000051B000-memory.dmp family_blackmoon -
Processes:
resource yara_rule behavioral4/memory/3048-0-0x0000000000400000-0x000000000051B000-memory.dmp upx behavioral4/memory/3048-53-0x0000000000400000-0x000000000051B000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
QQ牧场宝贝.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\IESettingSync QQ牧场宝贝.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" QQ牧场宝贝.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch QQ牧场宝贝.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" QQ牧场宝贝.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
QQ牧场宝贝.exepid process 3048 QQ牧场宝贝.exe 3048 QQ牧场宝贝.exe 3048 QQ牧场宝贝.exe 3048 QQ牧场宝贝.exe 3048 QQ牧场宝贝.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3048-0-0x0000000000400000-0x000000000051B000-memory.dmpFilesize
1.1MB
-
memory/3048-2-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-50-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-52-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-51-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-47-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-46-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-43-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-41-0x00000000006D0000-0x00000000006D1000-memory.dmpFilesize
4KB
-
memory/3048-40-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-37-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-35-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-33-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-31-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-29-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-27-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-23-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-21-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-19-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-17-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-15-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-7-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-25-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-13-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-11-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-9-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-4-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-3-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-53-0x0000000000400000-0x000000000051B000-memory.dmpFilesize
1.1MB
-
memory/3048-54-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/3048-56-0x00000000006D0000-0x00000000006D1000-memory.dmpFilesize
4KB