Analysis
-
max time kernel
36s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
29-05-2023 08:17
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
windows7-x64
10 signatures
150 seconds
General
-
Target
tmp.exe
-
Size
277KB
-
MD5
5ac529b84bed8f7e3428245e47a78667
-
SHA1
3da3922f429143ccb6d0c3224e3d189c9bb31fa6
-
SHA256
1989d2f3db46b9c5c949f4b8498cda2a2fde7b08e4c5d1267950debe82daa2fc
-
SHA512
1093d5ddb6c4834b0b8389dc9fa648aad37ab9b170c908e6b9bb37354e1b3906db0b8485a44ab3b0a545bbe2868bfe6229488830b9c925c26f3a78bd83166962
-
SSDEEP
6144:sbFMvcdKa1rEgjpI+tK9/DYag1dNqaFm:sbFMEdKa1Jjl89/DYayT
Malware Config
Signatures
-
Detect Blackmoon payload 12 IoCs
Processes:
resource yara_rule behavioral1/memory/1372-60-0x0000000000400000-0x0000000000454000-memory.dmp family_blackmoon behavioral1/memory/1372-62-0x0000000000400000-0x0000000000454000-memory.dmp family_blackmoon behavioral1/memory/1372-65-0x0000000000400000-0x0000000000454000-memory.dmp family_blackmoon behavioral1/memory/1372-69-0x0000000010000000-0x0000000010062000-memory.dmp family_blackmoon behavioral1/memory/1372-68-0x0000000010000000-0x0000000010062000-memory.dmp family_blackmoon behavioral1/memory/1372-70-0x0000000010000000-0x0000000010062000-memory.dmp family_blackmoon behavioral1/memory/1372-71-0x0000000000130000-0x0000000000147000-memory.dmp family_blackmoon behavioral1/memory/1372-78-0x0000000010000000-0x0000000010062000-memory.dmp family_blackmoon behavioral1/memory/1372-79-0x0000000010000000-0x0000000010062000-memory.dmp family_blackmoon behavioral1/memory/1372-103-0x00000000024C0000-0x0000000002514000-memory.dmp family_blackmoon behavioral1/memory/1372-107-0x0000000003570000-0x00000000035F8000-memory.dmp family_blackmoon behavioral1/memory/1372-120-0x0000000010000000-0x0000000010062000-memory.dmp family_blackmoon -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1372 svchost.exe -
Processes:
resource yara_rule behavioral1/memory/1372-66-0x0000000010000000-0x0000000010062000-memory.dmp upx behavioral1/memory/1372-69-0x0000000010000000-0x0000000010062000-memory.dmp upx behavioral1/memory/1372-68-0x0000000010000000-0x0000000010062000-memory.dmp upx behavioral1/memory/1372-70-0x0000000010000000-0x0000000010062000-memory.dmp upx behavioral1/memory/1372-74-0x00000000001E0000-0x0000000000269000-memory.dmp upx behavioral1/memory/1372-75-0x00000000001E0000-0x0000000000269000-memory.dmp upx behavioral1/memory/1372-77-0x00000000001E0000-0x0000000000269000-memory.dmp upx behavioral1/memory/1372-78-0x0000000010000000-0x0000000010062000-memory.dmp upx behavioral1/memory/1372-79-0x0000000010000000-0x0000000010062000-memory.dmp upx behavioral1/memory/1372-110-0x0000000003600000-0x0000000003689000-memory.dmp upx behavioral1/memory/1372-111-0x0000000003600000-0x0000000003689000-memory.dmp upx behavioral1/memory/1372-113-0x0000000003600000-0x0000000003689000-memory.dmp upx behavioral1/memory/1372-120-0x0000000010000000-0x0000000010062000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tmp.exedescription pid process target process PID 1048 set thread context of 1372 1048 tmp.exe svchost.exe -
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main svchost.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
svchost.exepid process 1372 svchost.exe 1372 svchost.exe 1372 svchost.exe 1372 svchost.exe 1372 svchost.exe 1372 svchost.exe 1372 svchost.exe 1372 svchost.exe 1372 svchost.exe 1372 svchost.exe 1372 svchost.exe 1372 svchost.exe 1372 svchost.exe 1372 svchost.exe 1372 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
tmp.exesvchost.exedescription pid process Token: SeDebugPrivilege 1048 tmp.exe Token: SeDebugPrivilege 1372 svchost.exe Token: SeDebugPrivilege 1372 svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
svchost.exepid process 1372 svchost.exe 1372 svchost.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
tmp.exedescription pid process target process PID 1048 wrote to memory of 1372 1048 tmp.exe svchost.exe PID 1048 wrote to memory of 1372 1048 tmp.exe svchost.exe PID 1048 wrote to memory of 1372 1048 tmp.exe svchost.exe PID 1048 wrote to memory of 1372 1048 tmp.exe svchost.exe PID 1048 wrote to memory of 1372 1048 tmp.exe svchost.exe PID 1048 wrote to memory of 1372 1048 tmp.exe svchost.exe PID 1048 wrote to memory of 1372 1048 tmp.exe svchost.exe PID 1048 wrote to memory of 1372 1048 tmp.exe svchost.exe PID 1048 wrote to memory of 1372 1048 tmp.exe svchost.exe PID 1048 wrote to memory of 1372 1048 tmp.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\syswow64\svchost.exec:\windows\syswow64\svchost.exe2⤵
- Deletes itself
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1372-54-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/1372-55-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/1372-56-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/1372-58-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/1372-60-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/1372-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1372-62-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/1372-65-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/1372-66-0x0000000010000000-0x0000000010062000-memory.dmpFilesize
392KB
-
memory/1372-69-0x0000000010000000-0x0000000010062000-memory.dmpFilesize
392KB
-
memory/1372-68-0x0000000010000000-0x0000000010062000-memory.dmpFilesize
392KB
-
memory/1372-70-0x0000000010000000-0x0000000010062000-memory.dmpFilesize
392KB
-
memory/1372-71-0x0000000000130000-0x0000000000147000-memory.dmpFilesize
92KB
-
memory/1372-74-0x00000000001E0000-0x0000000000269000-memory.dmpFilesize
548KB
-
memory/1372-75-0x00000000001E0000-0x0000000000269000-memory.dmpFilesize
548KB
-
memory/1372-77-0x00000000001E0000-0x0000000000269000-memory.dmpFilesize
548KB
-
memory/1372-78-0x0000000010000000-0x0000000010062000-memory.dmpFilesize
392KB
-
memory/1372-79-0x0000000010000000-0x0000000010062000-memory.dmpFilesize
392KB
-
memory/1372-98-0x0000000000800000-0x0000000000900000-memory.dmpFilesize
1024KB
-
memory/1372-97-0x0000000000800000-0x0000000000900000-memory.dmpFilesize
1024KB
-
memory/1372-100-0x0000000000800000-0x0000000000900000-memory.dmpFilesize
1024KB
-
memory/1372-101-0x0000000000800000-0x0000000000900000-memory.dmpFilesize
1024KB
-
memory/1372-103-0x00000000024C0000-0x0000000002514000-memory.dmpFilesize
336KB
-
memory/1372-107-0x0000000003570000-0x00000000035F8000-memory.dmpFilesize
544KB
-
memory/1372-110-0x0000000003600000-0x0000000003689000-memory.dmpFilesize
548KB
-
memory/1372-111-0x0000000003600000-0x0000000003689000-memory.dmpFilesize
548KB
-
memory/1372-113-0x0000000003600000-0x0000000003689000-memory.dmpFilesize
548KB
-
memory/1372-120-0x0000000010000000-0x0000000010062000-memory.dmpFilesize
392KB
-
memory/1372-122-0x0000000000B40000-0x0000000000B41000-memory.dmpFilesize
4KB