Analysis
-
max time kernel
135s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2023 02:22
Behavioral task
behavioral1
Sample
08dbd438e6da6ed529558bf13b17090346fc43c864aaa5981f4edabb15eb4e19.exe
Resource
win7-20230220-en
General
-
Target
08dbd438e6da6ed529558bf13b17090346fc43c864aaa5981f4edabb15eb4e19.exe
-
Size
232KB
-
MD5
511ef2a273cf6aa9ed79a5ba1d20732a
-
SHA1
b2973d6fa4e44bbd23b0dd8a59023da51255091f
-
SHA256
08dbd438e6da6ed529558bf13b17090346fc43c864aaa5981f4edabb15eb4e19
-
SHA512
d8b7fde518e794f9d4066d548afd25fd2371300daa190572bd4c92306d0a637e5ae113b6cd29fdcb176c7ba7f60c0324a42a3d5423bd304e17c22d46a3592879
-
SSDEEP
3072:D3VmqeE1i0jbQEYvubUHVIHRvwtGyod8tEB1EpWtDiMNUavlm8+:D3VmqeE11jivGUHVUhyosGDiMb5
Malware Config
Signatures
-
Detect Blackmoon payload 3 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\rnCgJYc.exe family_blackmoon C:\Windows\SysWOW64\rnCgJYc.exe family_blackmoon C:\Windows\SysWOW64\rnCgJYc.exe family_blackmoon -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
08dbd438e6da6ed529558bf13b17090346fc43c864aaa5981f4edabb15eb4e19.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation 08dbd438e6da6ed529558bf13b17090346fc43c864aaa5981f4edabb15eb4e19.exe -
Executes dropped EXE 1 IoCs
Processes:
rnCgJYc.exepid process 1676 rnCgJYc.exe -
Processes:
resource yara_rule behavioral2/memory/1676-143-0x0000000001F90000-0x0000000001F9A000-memory.dmp upx behavioral2/memory/1676-144-0x0000000001F90000-0x0000000001F9A000-memory.dmp upx behavioral2/memory/1676-160-0x00000000127D0000-0x00000000127DB000-memory.dmp upx behavioral2/memory/1676-171-0x00000000127D0000-0x00000000127DB000-memory.dmp upx behavioral2/memory/1676-191-0x00000000127D0000-0x00000000127DB000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
08dbd438e6da6ed529558bf13b17090346fc43c864aaa5981f4edabb15eb4e19.exedescription ioc process File created C:\Windows\SysWOW64\rnCgJYc.exe 08dbd438e6da6ed529558bf13b17090346fc43c864aaa5981f4edabb15eb4e19.exe File opened for modification C:\Windows\SysWOW64\rnCgJYc.exe 08dbd438e6da6ed529558bf13b17090346fc43c864aaa5981f4edabb15eb4e19.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rnCgJYc.exepid process 1676 rnCgJYc.exe 1676 rnCgJYc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
08dbd438e6da6ed529558bf13b17090346fc43c864aaa5981f4edabb15eb4e19.exernCgJYc.exedescription pid process Token: SeIncBasePriorityPrivilege 3128 08dbd438e6da6ed529558bf13b17090346fc43c864aaa5981f4edabb15eb4e19.exe Token: SeDebugPrivilege 1676 rnCgJYc.exe Token: SeDebugPrivilege 1676 rnCgJYc.exe Token: SeDebugPrivilege 1676 rnCgJYc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
08dbd438e6da6ed529558bf13b17090346fc43c864aaa5981f4edabb15eb4e19.exernCgJYc.exepid process 3128 08dbd438e6da6ed529558bf13b17090346fc43c864aaa5981f4edabb15eb4e19.exe 1676 rnCgJYc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
08dbd438e6da6ed529558bf13b17090346fc43c864aaa5981f4edabb15eb4e19.exedescription pid process target process PID 3128 wrote to memory of 1676 3128 08dbd438e6da6ed529558bf13b17090346fc43c864aaa5981f4edabb15eb4e19.exe rnCgJYc.exe PID 3128 wrote to memory of 1676 3128 08dbd438e6da6ed529558bf13b17090346fc43c864aaa5981f4edabb15eb4e19.exe rnCgJYc.exe PID 3128 wrote to memory of 1676 3128 08dbd438e6da6ed529558bf13b17090346fc43c864aaa5981f4edabb15eb4e19.exe rnCgJYc.exe PID 3128 wrote to memory of 1464 3128 08dbd438e6da6ed529558bf13b17090346fc43c864aaa5981f4edabb15eb4e19.exe cmd.exe PID 3128 wrote to memory of 1464 3128 08dbd438e6da6ed529558bf13b17090346fc43c864aaa5981f4edabb15eb4e19.exe cmd.exe PID 3128 wrote to memory of 1464 3128 08dbd438e6da6ed529558bf13b17090346fc43c864aaa5981f4edabb15eb4e19.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08dbd438e6da6ed529558bf13b17090346fc43c864aaa5981f4edabb15eb4e19.exe"C:\Users\Admin\AppData\Local\Temp\08dbd438e6da6ed529558bf13b17090346fc43c864aaa5981f4edabb15eb4e19.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rnCgJYc.exe"C:\Windows\system32\rnCgJYc.exe" -auto2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\08DBD4~1.EXE > nul2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\rnCgJYc.exeFilesize
232KB
MD5511ef2a273cf6aa9ed79a5ba1d20732a
SHA1b2973d6fa4e44bbd23b0dd8a59023da51255091f
SHA25608dbd438e6da6ed529558bf13b17090346fc43c864aaa5981f4edabb15eb4e19
SHA512d8b7fde518e794f9d4066d548afd25fd2371300daa190572bd4c92306d0a637e5ae113b6cd29fdcb176c7ba7f60c0324a42a3d5423bd304e17c22d46a3592879
-
C:\Windows\SysWOW64\rnCgJYc.exeFilesize
232KB
MD5511ef2a273cf6aa9ed79a5ba1d20732a
SHA1b2973d6fa4e44bbd23b0dd8a59023da51255091f
SHA25608dbd438e6da6ed529558bf13b17090346fc43c864aaa5981f4edabb15eb4e19
SHA512d8b7fde518e794f9d4066d548afd25fd2371300daa190572bd4c92306d0a637e5ae113b6cd29fdcb176c7ba7f60c0324a42a3d5423bd304e17c22d46a3592879
-
C:\Windows\SysWOW64\rnCgJYc.exeFilesize
232KB
MD5511ef2a273cf6aa9ed79a5ba1d20732a
SHA1b2973d6fa4e44bbd23b0dd8a59023da51255091f
SHA25608dbd438e6da6ed529558bf13b17090346fc43c864aaa5981f4edabb15eb4e19
SHA512d8b7fde518e794f9d4066d548afd25fd2371300daa190572bd4c92306d0a637e5ae113b6cd29fdcb176c7ba7f60c0324a42a3d5423bd304e17c22d46a3592879
-
memory/1676-144-0x0000000001F90000-0x0000000001F9A000-memory.dmpFilesize
40KB
-
memory/1676-160-0x00000000127D0000-0x00000000127DB000-memory.dmpFilesize
44KB
-
memory/1676-161-0x0000000012780000-0x0000000012781000-memory.dmpFilesize
4KB
-
memory/1676-143-0x0000000001F90000-0x0000000001F9A000-memory.dmpFilesize
40KB
-
memory/1676-170-0x0000000002220000-0x0000000002221000-memory.dmpFilesize
4KB
-
memory/1676-171-0x00000000127D0000-0x00000000127DB000-memory.dmpFilesize
44KB
-
memory/1676-172-0x00000000127B0000-0x00000000127B1000-memory.dmpFilesize
4KB
-
memory/1676-173-0x00000000127A0000-0x00000000127A1000-memory.dmpFilesize
4KB
-
memory/1676-174-0x0000000012790000-0x0000000012791000-memory.dmpFilesize
4KB
-
memory/1676-191-0x00000000127D0000-0x00000000127DB000-memory.dmpFilesize
44KB