Analysis
-
max time kernel
30s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
22-05-2023 07:01
Behavioral task
behavioral1
Sample
9eb4725043fb10627b7f57160a7d14eda203ddd4ac4d713d55d9eba78f640e96.dll
Resource
win7-20230220-en
windows7-x64
3 signatures
150 seconds
General
-
Target
9eb4725043fb10627b7f57160a7d14eda203ddd4ac4d713d55d9eba78f640e96.dll
-
Size
5.9MB
-
MD5
c137497f83cca78dbc03f8b6cd77936b
-
SHA1
203cf3522d61c4e3f5b98209509c875e4be529fc
-
SHA256
9eb4725043fb10627b7f57160a7d14eda203ddd4ac4d713d55d9eba78f640e96
-
SHA512
2657ac955a3c714c4e60acf8450acd223b235f5cca55e03a695641f3c0db4e8a7784f53b712854c7b8d76b18ab7505e66a5e37f7157ba9d376b8e4000b0bbaab
-
SSDEEP
98304:wiPDC+kAE9KBSzqiNoEqmSCG02GYG1MqvMYfVCetV6EY04:prnkJkTiNyG2Gd1McQelYv
Malware Config
Signatures
-
Detect Blackmoon payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2020-54-0x0000000010000000-0x00000000100B4000-memory.dmp family_blackmoon -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2004 wrote to memory of 2020 2004 rundll32.exe rundll32.exe PID 2004 wrote to memory of 2020 2004 rundll32.exe rundll32.exe PID 2004 wrote to memory of 2020 2004 rundll32.exe rundll32.exe PID 2004 wrote to memory of 2020 2004 rundll32.exe rundll32.exe PID 2004 wrote to memory of 2020 2004 rundll32.exe rundll32.exe PID 2004 wrote to memory of 2020 2004 rundll32.exe rundll32.exe PID 2004 wrote to memory of 2020 2004 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9eb4725043fb10627b7f57160a7d14eda203ddd4ac4d713d55d9eba78f640e96.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9eb4725043fb10627b7f57160a7d14eda203ddd4ac4d713d55d9eba78f640e96.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2020-54-0x0000000010000000-0x00000000100B4000-memory.dmpFilesize
720KB