Analysis
-
max time kernel
26s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 23:27
Behavioral task
behavioral1
Sample
6686cc875a4adf78aa0d282efc3a13944b7fd95c9ee262cf762edf17ff8c3c14.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
General
-
Target
6686cc875a4adf78aa0d282efc3a13944b7fd95c9ee262cf762edf17ff8c3c14.exe
-
Size
11.0MB
-
MD5
48d364a7ada809d065de104ac081f574
-
SHA1
bd98757417a1a381f065c65171d05e5256c799c9
-
SHA256
6686cc875a4adf78aa0d282efc3a13944b7fd95c9ee262cf762edf17ff8c3c14
-
SHA512
ac39151832e1acb764b5a9e6d9d9ddd89aa93c24e7bf361ba598fb1a1eb5b58b4329124261364dff3c0e0a7c3e43a676a3707da1d297b79d5edaf0ee293ec415
-
SSDEEP
196608:Zo+6V21shWOp620S6xmYY1b7TUoyiD3/x7XJNiVsv++bBziFQfx+kkhRK6+skCXK:421shWOp626mYY1tyiD3liVsv++bBzir
Malware Config
Signatures
-
Detect Blackmoon payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2036-54-0x0000000000400000-0x0000000000F27000-memory.dmp family_blackmoon behavioral1/memory/2036-56-0x0000000000400000-0x0000000000F27000-memory.dmp family_blackmoon behavioral1/memory/2036-58-0x0000000000400000-0x0000000000F27000-memory.dmp family_blackmoon -
Processes:
resource yara_rule behavioral1/memory/2036-54-0x0000000000400000-0x0000000000F27000-memory.dmp vmprotect behavioral1/memory/2036-56-0x0000000000400000-0x0000000000F27000-memory.dmp vmprotect behavioral1/memory/2036-58-0x0000000000400000-0x0000000000F27000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
6686cc875a4adf78aa0d282efc3a13944b7fd95c9ee262cf762edf17ff8c3c14.exepid process 2036 6686cc875a4adf78aa0d282efc3a13944b7fd95c9ee262cf762edf17ff8c3c14.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1984 2036 WerFault.exe 6686cc875a4adf78aa0d282efc3a13944b7fd95c9ee262cf762edf17ff8c3c14.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
6686cc875a4adf78aa0d282efc3a13944b7fd95c9ee262cf762edf17ff8c3c14.exepid process 2036 6686cc875a4adf78aa0d282efc3a13944b7fd95c9ee262cf762edf17ff8c3c14.exe 2036 6686cc875a4adf78aa0d282efc3a13944b7fd95c9ee262cf762edf17ff8c3c14.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
6686cc875a4adf78aa0d282efc3a13944b7fd95c9ee262cf762edf17ff8c3c14.exedescription pid process target process PID 2036 wrote to memory of 1984 2036 6686cc875a4adf78aa0d282efc3a13944b7fd95c9ee262cf762edf17ff8c3c14.exe WerFault.exe PID 2036 wrote to memory of 1984 2036 6686cc875a4adf78aa0d282efc3a13944b7fd95c9ee262cf762edf17ff8c3c14.exe WerFault.exe PID 2036 wrote to memory of 1984 2036 6686cc875a4adf78aa0d282efc3a13944b7fd95c9ee262cf762edf17ff8c3c14.exe WerFault.exe PID 2036 wrote to memory of 1984 2036 6686cc875a4adf78aa0d282efc3a13944b7fd95c9ee262cf762edf17ff8c3c14.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6686cc875a4adf78aa0d282efc3a13944b7fd95c9ee262cf762edf17ff8c3c14.exe"C:\Users\Admin\AppData\Local\Temp\6686cc875a4adf78aa0d282efc3a13944b7fd95c9ee262cf762edf17ff8c3c14.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 3402⤵
- Program crash
PID:1984
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1984-57-0x0000000000000000-mapping.dmp
-
memory/2036-54-0x0000000000400000-0x0000000000F27000-memory.dmpFilesize
11.2MB
-
memory/2036-55-0x0000000075C61000-0x0000000075C63000-memory.dmpFilesize
8KB
-
memory/2036-56-0x0000000000400000-0x0000000000F27000-memory.dmpFilesize
11.2MB
-
memory/2036-58-0x0000000000400000-0x0000000000F27000-memory.dmpFilesize
11.2MB