Analysis
-
max time kernel
157s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/12/2022, 02:41
Behavioral task
behavioral1
Sample
开票凭证.exe
Resource
win7-20220901-en
windows7-x64
13 signatures
150 seconds
General
-
Target
开票凭证.exe
-
Size
1.3MB
-
MD5
1c60e7207e61db844a6370cf1b622df0
-
SHA1
449073517012b23429415e7c3c5c612c110c2e2e
-
SHA256
a88e5a2f31e79c432851db48a9124a1314c0abd99ffa25594c1fbbd9bb0fc7eb
-
SHA512
709786d275fc5d05dc6853fe897b6903a441441a1929bbe67181344117a8bdec5b705bbcac9b39ff2258761c935b7fcd4f485c4885fa4fd4a251d36a538f5b39
-
SSDEEP
12288:8b+u1K85aSELSNGbJKwAVzu18UaxIMY9TV5nI/Foi+L7vtf3on:xu2SXNGbswABu6UDTV5n2Fw7vtf3on
Malware Config
Signatures
-
Detect Blackmoon payload 4 IoCs
resource yara_rule behavioral2/memory/1476-137-0x00000000032E0000-0x000000000335B000-memory.dmp family_blackmoon behavioral2/memory/1476-136-0x00000000032E0000-0x000000000335B000-memory.dmp family_blackmoon behavioral2/memory/1476-138-0x00000000032E0000-0x000000000335B000-memory.dmp family_blackmoon behavioral2/memory/1476-149-0x00000000032E0000-0x000000000335B000-memory.dmp family_blackmoon -
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/1476-145-0x0000000010000000-0x0000000010017000-memory.dmp family_gh0strat -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qdate = "C:\\Users\\Public\\Documents\\Applicationggzog.exe" 开票凭证.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run 开票凭证.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 开票凭证.exe File opened (read-only) \??\Y: 开票凭证.exe File opened (read-only) \??\E: 开票凭证.exe File opened (read-only) \??\G: 开票凭证.exe File opened (read-only) \??\I: 开票凭证.exe File opened (read-only) \??\K: 开票凭证.exe File opened (read-only) \??\O: 开票凭证.exe File opened (read-only) \??\U: 开票凭证.exe File opened (read-only) \??\W: 开票凭证.exe File opened (read-only) \??\X: 开票凭证.exe File opened (read-only) \??\F: 开票凭证.exe File opened (read-only) \??\Q: 开票凭证.exe File opened (read-only) \??\R: 开票凭证.exe File opened (read-only) \??\N: 开票凭证.exe File opened (read-only) \??\H: 开票凭证.exe File opened (read-only) \??\L: 开票凭证.exe File opened (read-only) \??\M: 开票凭证.exe File opened (read-only) \??\P: 开票凭证.exe File opened (read-only) \??\S: 开票凭证.exe File opened (read-only) \??\T: 开票凭证.exe File opened (read-only) \??\V: 开票凭证.exe File opened (read-only) \??\B: 开票凭证.exe File opened (read-only) \??\Z: 开票凭证.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 开票凭证.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 开票凭证.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 1476 开票凭证.exe Token: SeIncBasePriorityPrivilege 1476 开票凭证.exe Token: 33 1476 开票凭证.exe Token: SeIncBasePriorityPrivilege 1476 开票凭证.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe 1476 开票凭证.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\开票凭证.exe"C:\Users\Admin\AppData\Local\Temp\开票凭证.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1476