Analysis
-
max time kernel
153s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 06:06
Static task
static1
Behavioral task
behavioral1
Sample
be5111324bcafce07aa6964bcaaf38a6ba9b36a4b1b933e4c528ca27c66f9c19.dll
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
General
-
Target
be5111324bcafce07aa6964bcaaf38a6ba9b36a4b1b933e4c528ca27c66f9c19.dll
-
Size
14KB
-
MD5
05af806443adadd7fc86b4118a630840
-
SHA1
05f10e42d0465219e36aaccb6db73c160628759c
-
SHA256
be5111324bcafce07aa6964bcaaf38a6ba9b36a4b1b933e4c528ca27c66f9c19
-
SHA512
f4d37924223c897320b402988b27088c5a220fe08aab95db197cea8e1c715b79c94914ab3376a804dc7ee202ffe0ff604a5638ffc3e7a115bd2d05e118634890
-
SSDEEP
384:p3fpa2vDcNsyySVu2zMZzv3+ODnU8RBsAVxgOsIRJXuGK:ba2wWyPU2a/ZbRBsAVqsbXu
Malware Config
Signatures
-
Detect Blackmoon payload 3 IoCs
resource yara_rule behavioral2/memory/1052-133-0x0000000010000000-0x0000000010013000-memory.dmp family_blackmoon behavioral2/memory/1052-134-0x0000000010000000-0x0000000010013000-memory.dmp family_blackmoon behavioral2/memory/1052-135-0x0000000010000000-0x0000000010013000-memory.dmp family_blackmoon -
Blocklisted process makes network request 64 IoCs
flow pid Process 6 1052 rundll32.exe 8 1052 rundll32.exe 9 1052 rundll32.exe 11 1052 rundll32.exe 13 1052 rundll32.exe 19 1052 rundll32.exe 23 1052 rundll32.exe 24 1052 rundll32.exe 25 1052 rundll32.exe 27 1052 rundll32.exe 29 1052 rundll32.exe 35 1052 rundll32.exe 36 1052 rundll32.exe 37 1052 rundll32.exe 40 1052 rundll32.exe 41 1052 rundll32.exe 44 1052 rundll32.exe 45 1052 rundll32.exe 46 1052 rundll32.exe 47 1052 rundll32.exe 48 1052 rundll32.exe 51 1052 rundll32.exe 53 1052 rundll32.exe 56 1052 rundll32.exe 57 1052 rundll32.exe 58 1052 rundll32.exe 59 1052 rundll32.exe 60 1052 rundll32.exe 78 1052 rundll32.exe 79 1052 rundll32.exe 80 1052 rundll32.exe 82 1052 rundll32.exe 83 1052 rundll32.exe 84 1052 rundll32.exe 85 1052 rundll32.exe 87 1052 rundll32.exe 92 1052 rundll32.exe 93 1052 rundll32.exe 95 1052 rundll32.exe 98 1052 rundll32.exe 99 1052 rundll32.exe 103 1052 rundll32.exe 104 1052 rundll32.exe 105 1052 rundll32.exe 106 1052 rundll32.exe 107 1052 rundll32.exe 108 1052 rundll32.exe 109 1052 rundll32.exe 110 1052 rundll32.exe 112 1052 rundll32.exe 113 1052 rundll32.exe 114 1052 rundll32.exe 115 1052 rundll32.exe 116 1052 rundll32.exe 120 1052 rundll32.exe 123 1052 rundll32.exe 124 1052 rundll32.exe 127 1052 rundll32.exe 128 1052 rundll32.exe 129 1052 rundll32.exe 130 1052 rundll32.exe 132 1052 rundll32.exe 133 1052 rundll32.exe 134 1052 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3024 wrote to memory of 1052 3024 rundll32.exe 81 PID 3024 wrote to memory of 1052 3024 rundll32.exe 81 PID 3024 wrote to memory of 1052 3024 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\be5111324bcafce07aa6964bcaaf38a6ba9b36a4b1b933e4c528ca27c66f9c19.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\be5111324bcafce07aa6964bcaaf38a6ba9b36a4b1b933e4c528ca27c66f9c19.dll,#12⤵
- Blocklisted process makes network request
PID:1052
-