Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
18-04-2023 01:16
Behavioral task
behavioral1
Sample
88a60f105af4a2d97c845a83344577c85bb950cca5d3085215c8574c0408c54f.exe
Resource
win7-20230220-en
windows7-x64
4 signatures
150 seconds
General
-
Target
88a60f105af4a2d97c845a83344577c85bb950cca5d3085215c8574c0408c54f.exe
-
Size
256KB
-
MD5
33bc61ea85462f13301671fca3643c2f
-
SHA1
4c9fc4f0a2ca60312205827f1ed40cfdfaeb4088
-
SHA256
88a60f105af4a2d97c845a83344577c85bb950cca5d3085215c8574c0408c54f
-
SHA512
38c73b3f41b545a0c14b1f72bd4c7f12e5f190c9fa293a41499da6f714991f69b3558c17bb6b10879f6bf03b2ec0b306706146450b85e15e9bc9edd90c3429e3
-
SSDEEP
6144:XJV3UHerayaIqYP7IZAtuwhL8TPVCZ6Tf5AWcTHeZST5l4T:XJlwerE/YP7ItwhL8ZCkz2r+4d
Malware Config
Signatures
-
Detect Blackmoon payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2036-54-0x0000000000400000-0x00000000004AA000-memory.dmp family_blackmoon behavioral1/memory/2036-55-0x0000000000400000-0x00000000004AA000-memory.dmp family_blackmoon behavioral1/memory/2036-57-0x0000000000400000-0x00000000004AA000-memory.dmp family_blackmoon -
Processes:
resource yara_rule behavioral1/memory/2036-56-0x0000000000270000-0x000000000027A000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
88a60f105af4a2d97c845a83344577c85bb950cca5d3085215c8574c0408c54f.exedescription pid process Token: SeDebugPrivilege 2036 88a60f105af4a2d97c845a83344577c85bb950cca5d3085215c8574c0408c54f.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2036-54-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2036-55-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2036-56-0x0000000000270000-0x000000000027A000-memory.dmpFilesize
40KB
-
memory/2036-57-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB