Behavioral task
behavioral1
Sample
28722c23d5526b96411a106b64446d5dd2802b8b816064962bb4e5b655c6e46d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
28722c23d5526b96411a106b64446d5dd2802b8b816064962bb4e5b655c6e46d.exe
Resource
win10v2004-20220812-en
General
-
Target
28722c23d5526b96411a106b64446d5dd2802b8b816064962bb4e5b655c6e46d
-
Size
838KB
-
MD5
9c243b2c22ef54f1f5b0a459d9f530d3
-
SHA1
b7b9997e5edd0726285734864ef6cdc9c018eb34
-
SHA256
28722c23d5526b96411a106b64446d5dd2802b8b816064962bb4e5b655c6e46d
-
SHA512
c720b5312802dbe728daf9cd1252263a99cb008c5925fde2802438f248ceb44248e71d4d4eab05d057b0d429e01239fa45b7371a490090310d3d29514177a5b8
-
SSDEEP
12288:qZBUNjhCuCjsaj9F+F47R4sZzlUUPr1k/7s2p6I9KoSb+lQ5rr/:qjUthCZjsaj9FY47RdUo67b94+lQ5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
Processes:
resource yara_rule sample family_blackmoon
Files
-
28722c23d5526b96411a106b64446d5dd2802b8b816064962bb4e5b655c6e46d.exe windows x86
e753c2e5c93b5c6f0ce886c3dea9b1cd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MultiByteToWideChar
lstrcpyn
GetLastError
CreateThread
TerminateThread
CloseHandle
LocalAlloc
LocalFree
OpenProcess
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetCommandLineA
GetModuleFileNameA
SetCurrentDirectoryA
WriteFile
SetFilePointer
ReadFile
GetFileSize
CreateFileA
GetCurrentDirectoryA
GetPrivateProfileStringA
SetEndOfFile
GetTickCount
Sleep
FindNextFileA
FindFirstFileA
FindClose
WritePrivateProfileStringA
WideCharToMultiByte
GetUserDefaultLCID
FreeLibrary
LCMapStringA
GetCurrentThreadId
DeleteCriticalSection
GetFileType
GetTimeFormatA
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
TerminateProcess
RtlFillMemory
RtlUnwind
GetVersion
GetStartupInfoA
CopyFileA
FindResourceA
FlushFileBuffers
LoadResource
LockResource
SizeofResource
FreeResource
OpenFile
lstrlenW
lstrcpynA
GetCurrentProcess
SetPriorityClass
GetVersionExA
DeviceIoControl
OutputDebugStringA
DebugBreak
InterlockedIncrement
InterlockedDecrement
GetSystemDirectoryA
DeleteFileA
VirtualQuery
TlsSetValue
GetDateFormatA
GetStdHandle
GetLocalTime
TlsAlloc
SetLastError
TlsGetValue
GetEnvironmentVariableA
HeapDestroy
HeapCreate
IsBadWritePtr
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
LCMapStringW
HeapSize
GetCPInfo
lstrlenA
GetProcAddress
LoadLibraryA
VirtualFree
VirtualAlloc
RaiseException
RtlMoveMemory
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
user32
MessageBeep
RegisterWindowMessageA
wvsprintfA
CreateWindowStationA
MsgWaitForMultipleObjects
UnregisterHotKey
RegisterHotKey
SetWindowLongA
CallWindowProcA
CharNextA
CharUpperA
GetSystemMetrics
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
GetWindowThreadProcessId
CharLowerA
MessageBoxA
ole32
CLSIDFromString
OleRun
CoUninitialize
CoInitialize
CoCreateInstance
CLSIDFromProgID
CoSetProxyBlanket
oleaut32
SafeArrayDestroy
VariantClear
SysAllocString
SafeArrayCreate
RegisterTypeLi
LHashValOfNameSys
LoadTypeLi
VarR8FromBool
VarR8FromCy
VariantInit
SafeArrayGetElemsize
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
VariantChangeType
SafeArrayGetDim
SafeArrayGetLBound
shlwapi
PathFileExistsA
StrToIntExA
shell32
ShellExecuteA
SHCreateDirectoryExA
wininet
InternetSetCookieA
HttpQueryInfoA
InternetReadFile
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetCloseHandle
InternetConnectA
InternetOpenA
advapi32
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
CryptGetHashParam
ws2_32
WSAAsyncSelect
WSACleanup
WSAGetLastError
setsockopt
getpeername
getsockname
inet_ntoa
ntohs
recvfrom
sendto
accept
listen
recv
send
closesocket
__WSAFDIsSet
select
connect
gethostbyname
bind
htons
WSASetLastError
inet_addr
htonl
socket
WSAStartup
psapi
GetProcessMemoryInfo
Sections
.text Size: 392KB - Virtual size: 388KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 308KB - Virtual size: 384KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE