Analysis
-
max time kernel
151s -
max time network
67s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
26-05-2023 10:37
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
windows7-x64
8 signatures
150 seconds
General
-
Target
tmp.exe
-
Size
99KB
-
MD5
6208c83f58b432ccf579c828f0a8e336
-
SHA1
0ebb82b9abf8426dc1627e8043a712dd3aa40e54
-
SHA256
bb0f3f532cb2254c3e4fb6a84ed3573d8586531a7ff9659fb92288e18f5b1fe3
-
SHA512
a8001330b18ea98e6a3955ba5b49592549a96d240c1580816085e9295b0712a68a53afcf7921c724f18a9b9e1bf40659a10485ab1141007172a3ca17b9b58c10
-
SSDEEP
1536:jhMa8yEH/PZwoo5psi8SIWe94eg1Wcb1kj+x/JmNApp8CVFoFucbpYBGqfw:jV8rf+ooTsV8eBM6S9JYUp8CVjJMqo
Malware Config
Signatures
-
Detect Blackmoon payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1244-70-0x0000000000400000-0x0000000000458000-memory.dmp family_blackmoon behavioral1/memory/1244-71-0x0000000000400000-0x0000000000458000-memory.dmp family_blackmoon behavioral1/memory/1520-81-0x0000000000400000-0x0000000000458000-memory.dmp family_blackmoon -
Deletes itself 1 IoCs
Processes:
ctfmon.exepid process 1244 ctfmon.exe -
Processes:
resource yara_rule behavioral1/memory/1244-61-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1244-63-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1244-65-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1244-69-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1244-70-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1244-71-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1520-81-0x0000000000400000-0x0000000000458000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tmp.exedescription pid process target process PID 1520 set thread context of 1244 1520 tmp.exe ctfmon.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ctfmon.exepid process 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe 1244 ctfmon.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tmp.exectfmon.exedescription pid process Token: SeDebugPrivilege 1520 tmp.exe Token: SeDebugPrivilege 1244 ctfmon.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
tmp.exedescription pid process target process PID 1520 wrote to memory of 1244 1520 tmp.exe ctfmon.exe PID 1520 wrote to memory of 1244 1520 tmp.exe ctfmon.exe PID 1520 wrote to memory of 1244 1520 tmp.exe ctfmon.exe PID 1520 wrote to memory of 1244 1520 tmp.exe ctfmon.exe PID 1520 wrote to memory of 1244 1520 tmp.exe ctfmon.exe PID 1520 wrote to memory of 1244 1520 tmp.exe ctfmon.exe PID 1520 wrote to memory of 1244 1520 tmp.exe ctfmon.exe PID 1520 wrote to memory of 1244 1520 tmp.exe ctfmon.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ctfmon.exeC:\Windows\system32\ctfmon.exe 1520 C:\Users\Admin\AppData\Local\Temp\tmp.exe2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1244-60-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1244-61-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1244-63-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1244-65-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1244-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1244-69-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1244-70-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1244-71-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1520-81-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB