Analysis
-
max time kernel
95s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
22-02-2023 18:46
Static task
static1
Behavioral task
behavioral1
Sample
0180ff660a7ec9d3b779ccfad95574e4733e5295e4b87c2fbd680bc6605ec578.dll
Resource
win7-20230220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0180ff660a7ec9d3b779ccfad95574e4733e5295e4b87c2fbd680bc6605ec578.dll
-
Size
1.7MB
-
MD5
aec39486edec830e24e5776a851dfc61
-
SHA1
9188afbcde535ffbea2938d70fde467c2061046d
-
SHA256
0180ff660a7ec9d3b779ccfad95574e4733e5295e4b87c2fbd680bc6605ec578
-
SHA512
d713f79da34153aebcdf41b675f4709485a16394d2a35a6f14488fec1326ec90c1a993a50439bfd5a35ed6142a453d0bd2d32e7175563a2b519895bf3d6a6b2d
-
SSDEEP
24576:kNoPvgBvuxzIIiCSJYkpZd2B9wdJKQEbFvZDQ2C9dr5Hdj4yM28Vqwo7Z:45qzLiCSSLBC9Sk2CnrBjobo
Malware Config
Signatures
-
Detect Blackmoon payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2576-133-0x0000000010000000-0x0000000010518000-memory.dmp family_blackmoon -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 6 2576 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
rundll32.exepid process 2576 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4864 wrote to memory of 2576 4864 rundll32.exe rundll32.exe PID 4864 wrote to memory of 2576 4864 rundll32.exe rundll32.exe PID 4864 wrote to memory of 2576 4864 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0180ff660a7ec9d3b779ccfad95574e4733e5295e4b87c2fbd680bc6605ec578.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0180ff660a7ec9d3b779ccfad95574e4733e5295e4b87c2fbd680bc6605ec578.dll,#12⤵
- Blocklisted process makes network request
- Suspicious use of SetWindowsHookEx