Behavioral task
behavioral1
Sample
07530199.exe
Resource
win7-20230220-en
General
-
Target
07530199.exe
-
Size
277KB
-
MD5
5ac529b84bed8f7e3428245e47a78667
-
SHA1
3da3922f429143ccb6d0c3224e3d189c9bb31fa6
-
SHA256
1989d2f3db46b9c5c949f4b8498cda2a2fde7b08e4c5d1267950debe82daa2fc
-
SHA512
1093d5ddb6c4834b0b8389dc9fa648aad37ab9b170c908e6b9bb37354e1b3906db0b8485a44ab3b0a545bbe2868bfe6229488830b9c925c26f3a78bd83166962
-
SSDEEP
6144:sbFMvcdKa1rEgjpI+tK9/DYag1dNqaFm:sbFMEdKa1Jjl89/DYayT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
Processes:
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 07530199.exe
Files
-
07530199.exe.exe windows x86
79e9ed692a3ae78948516cece06d282b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MultiByteToWideChar
IsBadReadPtr
IsBadCodePtr
lstrlenW
WideCharToMultiByte
CreateWaitableTimerA
SetWaitableTimer
lstrcpyn
CreateToolhelp32Snapshot
Process32First
Process32Next
IsWow64Process
VirtualAllocEx
WriteProcessMemory
WaitForSingleObject
GetExitCodeThread
GetModuleFileNameW
GetEnvironmentVariableW
SetPriorityClass
GetCurrentThread
SetThreadPriority
ExitProcess
GetCurrentProcessId
GlobalAlloc
LocalFree
Module32First
GetTempPathW
QueryDosDeviceW
TerminateProcess
GetProcessHeap
GetModuleHandleA
HeapAlloc
HeapReAlloc
HeapFree
GetModuleFileNameA
ReadFile
GetFileSize
CreateFileA
DeleteFileA
GetUserDefaultLCID
GetEnvironmentVariableA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
LocalAlloc
LocalSize
IsDebuggerPresent
RtlMoveMemory
lstrcpynA
CloseHandle
OpenProcess
GetCurrentProcess
GlobalFree
OpenEventA
user32
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
PeekMessageA
GetMessageA
MsgWaitForMultipleObjects
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCloseKey
RegQueryValueExA
RegOpenKeyA
OpenProcessToken
iphlpapi
GetPerAdapterInfo
GetAdaptersInfo
ole32
CoInitialize
CoUninitialize
CoCreateInstance
CoSetProxyBlanket
OleRun
CLSIDFromString
CLSIDFromProgID
wininet
InternetOpenA
InternetConnectA
HttpOpenRequestA
InternetSetOptionA
InternetReadFile
HttpQueryInfoA
InternetCloseHandle
HttpSendRequestA
winhttp
WinHttpCrackUrl
WinHttpOpen
WinHttpSetTimeouts
WinHttpConnect
WinHttpOpenRequest
WinHttpSetCredentials
WinHttpCloseHandle
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpQueryHeaders
WinHttpCheckPlatform
oleaut32
SafeArrayUnaccessData
VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayGetElemsize
VarR8FromCy
VarR8FromBool
VariantChangeType
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantCopy
SafeArrayCreate
SysAllocString
SysFreeString
SafeArrayDestroy
VariantClear
shell32
ShellExecuteExW
SHChangeNotify
SHGetSpecialFolderPathW
psapi
GetProcessImageFileNameW
msvcrt
calloc
__CxxFrameHandler
strncmp
memmove
modf
realloc
_ftol
atoi
_CIfmod
malloc
free
strrchr
_stricmp
strchr
??3@YAXPAX@Z
??2@YAPAXI@Z
sprintf
shlwapi
PathFileExistsA
Sections
.text Size: 140KB - Virtual size: 139KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 464B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE